CVE-2019-1010259: SQL Injection in SaltStack Salt
Summary
CVE-2019-1010259: SaltStack Salt 2018.3, 2019.2 is affected by: SQL Injection. Affects salt versions < 2018.3.4. Fixed in 2018.3.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
SaltStack Salt is an open-source configuration management and remote execution framework. It is widely used for managing and automating infrastructure. The vulnerability identified as CVE-2019-1010259 affects Salt versions 2018.3 and 2019.2. This vulnerability allows an attacker to perform SQL injection, which can lead to privilege escalation on a MySQL server deployed by a cloud provider. Exploiting this vulnerability can result in remote code execution (RCE). The specific component affected is the mysql.user_chpass function from the MySQL module for Salt.
Vulnerability Detail
The vulnerability arises from a lack of proper input validation in the mysql.user_chpass function. An attacker can exploit this by providing a specially crafted password string. By injecting malicious SQL code, the attacker can manipulate the MySQL server and escalate their privileges. This can have severe consequences, including unauthorized access, data theft, and potential compromise of the entire system.
How To Fix
Latest published version: 3008.3.0 as of 22 Oct 2026
pip install --upgrade "salt==3008.3.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2018.3.4
This is the first release that contains the fix.
pip install --upgrade "salt==2018.3.4"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can disable the mysql.user_chpass function in the Salt configuration to prevent potential exploitation. However, this should only be considered as a short-term solution, and upgrading to a patched version is strongly advised.
Conclusion
The SQL injection vulnerability in SaltStack Salt can have serious consequences, including privilege escalation and remote code execution. It is crucial for users to upgrade to the patched version or apply the recommended workaround to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for salt →
FAQ
The vulnerability allows an attacker to escalate privileges on a MySQL server deployed by a cloud provider. This can lead to remote code execution and potential compromise of the entire system.
Salt versions 2018.3 and 2019.2 are affected by this vulnerability.
You can use the Vulert Playground at Vulert Scanner to check if your Salt installation is affected by this vulnerability. Simply provide your Pipfile.lock and it will analyze and alert you in real-time.
Yes, upgrading to Salt version 2018.3.4 or later will fix this vulnerability.
A temporary workaround is to disable the mysql.user_chpass function in the Salt configuration. However, upgrading to a patched version is strongly recommended.
References
Related vulnerabilities
Recent vulnerabilities recorded for salt.
