CVE-2020-11652: SaltStack Salt Arbitrary Directory Access
Summary
CVE-2020-11652: An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. Affects salt across 2 version ranges.
< 2019.2.4
>= 3000, < 3000.2
Fixed in 2019.2.4 or 3000.2, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
SaltStack Salt is an open-source configuration management and remote execution framework. It allows administrators to manage and automate the configuration of multiple systems. The vulnerability identified as CVE-2020-11652 affects versions of SaltStack Salt before 2019.2.4 and 3000 before 3000.2. The vulnerability resides in the salt-master process ClearFuncs class, which grants access to certain methods that do not properly sanitize paths. This flaw enables authenticated users to gain arbitrary directory access.
Vulnerability Detail
The vulnerability in SaltStack Salt allows authenticated users to bypass directory restrictions and access arbitrary directories. By exploiting this flaw, an attacker could potentially view, modify, or delete sensitive files and directories on the affected system. This could lead to unauthorized access, data leakage, or even complete system compromise. The issue was addressed in versions 2019.2.4 and 3000.2 of SaltStack Salt.
How To Fix
Latest published version: 3008.3.0 as of 22 Oct 2026
pip install --upgrade "salt==3008.3.0"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 2019.2.42019.2.4pip install --upgrade "salt==2019.2.4" -
>= 3000, < 3000.23000.2pip install --upgrade "salt==3000.2"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a workaround, users can restrict access to the salt-master process by implementing network-level access controls or firewall rules. Additionally, it is advisable to limit the privileges of authenticated users to minimize the potential impact of the vulnerability.
Conclusion
The vulnerability in SaltStack Salt allows authenticated users to gain arbitrary directory access, potentially leading to unauthorized actions and system compromise. It is crucial to upgrade to the patched versions of SaltStack Salt (2019.2.4 or 3000.2) to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for salt →
FAQ
The vulnerability allows authenticated users to access arbitrary directories, potentially leading to unauthorized access, data leakage, or system compromise.
Versions of SaltStack Salt before 2019.2.4 and 3000 before 3000.2 are affected by this vulnerability.
To fix the vulnerability, it is recommended to upgrade SaltStack Salt to version 2019.2.4 or 3000.2.
Implementing network-level access controls or firewall rules to restrict access to the salt-master process can serve as a temporary workaround.
More information about this vulnerability can be found in the SaltStack Salt advisory database.
Related vulnerabilities
Recent vulnerabilities recorded for salt.
