CVE-2017-8109: SaltStack Salt 2016.11 Configuration Leak
Summary
CVE-2017-8109: The salt-ssh minion code in SaltStack Salt 2016.11 before 2016.11.4 copied over configuration from the Salt Master without adjusting permissions, which might leak credentials to local attackers on configured minions (cli... Affects salt versions >= 2016.11, < 2016.11.4. Fixed in 2016.11.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
SaltStack Salt is an open-source configuration management and remote execution software. It allows administrators to manage and automate the configuration of multiple systems. The salt-ssh minion code in SaltStack Salt 2016.11 before version 2016.11.4 is affected by a vulnerability that can lead to the leakage of credentials on configured minions (clients).
Vulnerability Detail
The vulnerability arises from the salt-ssh minion code in SaltStack Salt 2016.11. When copying over configuration from the Salt Master, the permissions are not adjusted properly. This oversight enables local attackers on configured minions to potentially access and extract credentials. The leaked credentials can then be misused to gain unauthorized access to systems or perform other malicious activities.
How To Fix
Latest published version: 3008.3.0 as of 22 Oct 2026
pip install --upgrade "salt==3008.3.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2016.11.4
This is the first release that contains the fix.
pip install --upgrade "salt==2016.11.4"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, a temporary workaround is to manually adjust the permissions of the copied configuration files on the minions to restrict access. This can be done by modifying the file permissions using the appropriate commands for the operating system in use. For example, on Linux-based systems, the 'chmod' command can be used to set the permissions to restrict access to the files.
Conclusion
The vulnerability in SaltStack Salt 2016.11 before version 2016.11.4 can result in the leakage of credentials on configured minions. It is crucial to upgrade to the fixed version or apply the provided workaround to mitigate the risk of unauthorized access and potential misuse of credentials. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for salt →
FAQ
SaltStack Salt is an open-source configuration management and remote execution software that allows administrators to manage and automate the configuration of multiple systems.
This vulnerability can lead to the leakage of credentials on configured minions (clients), potentially enabling unauthorized access to systems or other malicious activities.
The vulnerability affects SaltStack Salt 2016.11 versions prior to 2016.11.4.
To fix this vulnerability, it is recommended to upgrade to SaltStack Salt version 2016.11.4 or later.
Yes, a temporary workaround is to manually adjust the permissions of the copied configuration files on the minions to restrict access.
References
Related vulnerabilities
Recent vulnerabilities recorded for salt.
