CVE-2017-7893: Impersonation Vulnerability in SaltStack Salt
Summary
CVE-2017-7893: In SaltStack Salt before 2016.3.6, compromised salt-minions can impersonate the salt-master. Affects salt versions < 2016.3.6. Fixed in 2016.3.6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
SaltStack Salt is an open-source configuration management and remote execution framework. It is designed to manage and automate the infrastructure of large-scale computer systems. SaltStack Salt allows administrators to control and configure multiple servers simultaneously. However, prior to version 2016.3.6, compromised salt-minions can impersonate the salt-master, leading to potential security breaches.
Vulnerability Detail
The vulnerability, identified as CVE-2017-7893, allows compromised salt-minions to impersonate the salt-master. This means that an attacker who has gained control over a salt-minion can masquerade as the salt-master and execute arbitrary commands on other minions. This can result in unauthorized access, data breaches, and the execution of malicious code on targeted systems. It is crucial to address this vulnerability promptly to prevent potential security incidents.
How To Fix
Latest published version: 3008.3.0 as of 22 Oct 2026
pip install --upgrade "salt==3008.3.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2016.3.6
This is the first release that contains the fix.
pip install --upgrade "salt==2016.3.6"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the recommended fix by upgrading to the patched version of SaltStack Salt.
Conclusion
The impersonation vulnerability in SaltStack Salt (CVE-2017-7893) poses a significant security risk as compromised salt-minions can impersonate the salt-master. To mitigate this vulnerability, it is crucial to upgrade to SaltStack Salt version 2016.3.6 or later. Failure to address this issue may result in unauthorized access, data breaches, and the execution of malicious code. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for salt →
FAQ
SaltStack Salt is an open-source configuration management and remote execution framework used for managing and automating large-scale computer systems.
This vulnerability allows compromised salt-minions to impersonate the salt-master, potentially leading to unauthorized access, data breaches, and the execution of malicious code on targeted systems.
To fix this vulnerability, it is recommended to upgrade SaltStack Salt to version 2016.3.6 or later, which includes the necessary security patches.
There is no known workaround for this vulnerability. Upgrading to the patched version of SaltStack Salt is the recommended solution.
For more information about this vulnerability, you can refer to the official CVE-2017-7893 advisory or consult the SaltStack Salt documentation.
References
Related vulnerabilities
Recent vulnerabilities recorded for salt.
