CVE-2021-3144: Open Source Vulnerability in SaltStack Salt

salt Updated 02 Oct 2025

Summary

27/02/2021

Disclosed on

CVE-2021-3144

CVE

Yes i

Fix available

Critical

Severity

9.1

CVSS Score

CVE-2021-3144: In SaltStack Salt before 3002.5, eauth tokens can be used once after expiration. (They might be used to run command against the salt master or minions.). Affects salt across 15 version ranges.

< 2015.8.10 >= 2015.8.11, < 2015.8.13 >= 2016.3.0, < 2016.3.4 >= 2016.3.5, < 2016.3.6 >= 2016.3.7, < 2016.3.8 >= 2016.11.0, < 2016.11.3 >= 2016.11.4, < 2016.11.5 >= 2016.11.7, < 2016.11.10 >= 2017.7.0, < 2017.7.8 >= 2018.3.0rc1, < 2019.2.0rc1 >= 2019.2.0, < 2019.2.5 >= 2019.2.6, < 2019.2.8 >= 3000, < 3000.6 >= 3001, < 3001.4 >= 3002, < 3002.5

Fixed in 15 releases; the minimum fixed version depends on the release line you run. How to fix ↓

Free scan

Check if this vulnerability affects your application

Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.

Check my app free

No signup required · Results in about 60 seconds

Upload your dependency manifest or SBOM

Drag & drop your file here or Browse

Java Javascript PHP Python Go Rust Ruby Dart C/C++ Elixir CycloneDX SPDX

Upload a supported dependency manifest or SBOM. No installation or source-code access required.

See supported files and SBOM formats

SBOM sbom.json · bom.json · bom.xml · *.spdx.json · *.cdx.json · *.cdx.xml

Java pom.xml · gradle.lockfile · buildscript-gradle.lockfile

Javascript package-lock.json · yarn.lock · pnpm-lock.yaml

PHP composer.lock

Python poetry.lock · requirements.txt · Pipfile.lock

Go go.mod

Rust Cargo.lock

Ruby Gemfile.lock

Dart pubspec.lock

C/C++ conan.lock

Elixir mix.lock

Enter your work email to receive your report link.

Verify your email to view the full report and start 30 days of continuous monitoring. No credit card required.

Background

SaltStack Salt is an open-source package that provides remote execution and configuration management capabilities. It is widely used for managing and controlling large-scale infrastructure. However, a vulnerability has been discovered in SaltStack Salt versions before 3002.5. This vulnerability allows eauth tokens to be used once after expiration, potentially enabling unauthorized access to the salt master or minions.

Vulnerability Detail

The vulnerability arises from a flaw in the handling of eauth tokens in SaltStack Salt. These tokens, which are used for authentication, can be exploited even after they have expired. An attacker could use a stolen or expired token to execute arbitrary commands against the salt master or minions, potentially leading to unauthorized access, data breaches, or system compromise.

How To Fix

Latest published version: 3008.3.0 as of 22 Oct 2026

pip install --upgrade "salt==3008.3.0"

Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.

If you can't move to the latest

The minimum fixed version depends on the release line you run.

< 2015.8.10 2015.8.10
```
pip install --upgrade "salt==2015.8.10"
```
>= 2015.8.11, < 2015.8.13 2015.8.13
```
pip install --upgrade "salt==2015.8.13"
```
>= 2016.3.0, < 2016.3.4 2016.3.4
```
pip install --upgrade "salt==2016.3.4"
```
>= 2016.3.5, < 2016.3.6 2016.3.6
```
pip install --upgrade "salt==2016.3.6"
```
>= 2016.3.7, < 2016.3.8 2016.3.8
```
pip install --upgrade "salt==2016.3.8"
```
>= 2016.11.0, < 2016.11.3 2016.11.3
```
pip install --upgrade "salt==2016.11.3"
```

Show all 15 release lines

>= 2016.11.4, < 2016.11.5 2016.11.5
```
pip install --upgrade "salt==2016.11.5"
```

>= 2016.11.7, < 2016.11.10 2016.11.10

pip install --upgrade "salt==2016.11.10"

>= 2017.7.0, < 2017.7.8 2017.7.8
```
pip install --upgrade "salt==2017.7.8"
```
>= 2018.3.0rc1, < 2019.2.0rc1 2019.2.0rc1
```
pip install --upgrade "salt==2019.2.0rc1"
```
>= 2019.2.0, < 2019.2.5 2019.2.5
```
pip install --upgrade "salt==2019.2.5"
```
>= 2019.2.6, < 2019.2.8 2019.2.8
```
pip install --upgrade "salt==2019.2.8"
```
>= 3000, < 3000.6 3000.6
```
pip install --upgrade "salt==3000.6"
```
>= 3001, < 3001.4 3001.4
```
pip install --upgrade "salt==3001.4"
```
>= 3002, < 3002.5 3002.5
```
pip install --upgrade "salt==3002.5"
```

Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →

Workaround

If upgrading to the latest version is not immediately feasible, a temporary workaround is to disable eauth token-based authentication and use alternative authentication mechanisms. This can be achieved by modifying the SaltStack configuration to remove or disable eauth-related settings. However, this workaround may impact the functionality and convenience of the system, so upgrading to the fixed version is strongly recommended.

Conclusion

The vulnerability in SaltStack Salt versions before 3002.5 allows eauth tokens to be used once after expiration, potentially leading to unauthorized access. Users are advised to upgrade to the latest version or apply the provided workaround to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.

See every vulnerability recorded for salt →

FAQ

What is SaltStack Salt?

SaltStack Salt is an open-source package that provides remote execution and configuration management capabilities. It is commonly used for managing and controlling large-scale infrastructure.

What is the impact of this vulnerability?

This vulnerability allows unauthorized access to the salt master or minions. An attacker could use a stolen or expired eauth token to execute arbitrary commands, potentially leading to data breaches, system compromise, or unauthorized actions.

Which versions of SaltStack Salt are affected?

SaltStack Salt versions before 3002.5 are affected by this vulnerability.

How can I fix this vulnerability?

To fix this vulnerability, it is recommended to upgrade to SaltStack Salt version 3002.5 or later. This version includes a fix for the eauth token expiration issue.

Is there a workaround available?

A temporary workaround is to disable eauth token-based authentication and use alternative authentication mechanisms. However, upgrading to the fixed version is strongly recommended.

References

Related vulnerabilities

Recent vulnerabilities recorded for salt.

View all salt vulnerabilities →