CVE-2022-22934: SaltStack Salt Arbitrary Pillar Data Substitution
Summary
CVE-2022-22934: An issue was discovered in SaltStack Salt in versions before 3002.8, 3003.4, 3004.1. Affects salt versions < 3002.8. Fixed in 3002.8. How to fix ↓
Also tracked for
- salt · Debian:10
The same CVE-2022-22934 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
SaltStack Salt is an open-source configuration management and remote execution framework. It is widely used for managing and automating infrastructure. Salt Masters are responsible for controlling and coordinating the Salt Minions, which are the agents running on the managed systems. Pillar data is a feature in SaltStack Salt that allows the configuration data to be securely shared between the Salt Master and Minions. This vulnerability allows attackers to substitute arbitrary pillar data without proper verification.
Vulnerability Detail
The issue in SaltStack Salt versions before 3002.8, 3003.4, and 3004.1 is that Salt Masters do not sign pillar data with the minion's public key. This lack of verification enables attackers to manipulate the pillar data and potentially execute unauthorized actions on the managed systems. By substituting arbitrary pillar data, an attacker could gain elevated privileges, bypass security controls, or cause system instability. This vulnerability poses a significant risk to the integrity and security of the SaltStack Salt deployment.
How To Fix
Latest published version: 3008.3.0 as of 22 Oct 2026
pip install --upgrade "salt==3008.3.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3002.8
This is the first release that contains the fix.
pip install --upgrade "salt==3002.8"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can manually verify the integrity of the pillar data by comparing it with a trusted source. This can be done by checking the signature of the pillar data using the minion's public key. However, this workaround is not recommended as it requires manual intervention and may not provide complete protection against the vulnerability. It is strongly advised to upgrade to the fixed version of SaltStack Salt.
Conclusion
The vulnerability in SaltStack Salt allows attackers to substitute arbitrary pillar data, potentially leading to unauthorized actions and compromising the integrity of the managed systems. It is crucial to upgrade to the fixed version of SaltStack Salt (3002.8 or later) to mitigate this vulnerability. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for salt →
FAQ
SaltStack Salt is an open-source configuration management and remote execution framework used for managing and automating infrastructure.
Pillar data is a feature in SaltStack Salt that allows the secure sharing of configuration data between the Salt Master and Minions.
This vulnerability allows attackers to substitute arbitrary pillar data, potentially gaining elevated privileges, bypassing security controls, or causing system instability.
To fix this vulnerability, it is recommended to upgrade SaltStack Salt to version 3002.8 or later.
A temporary workaround is to manually verify the integrity of the pillar data by comparing it with a trusted source. However, upgrading to the fixed version is strongly advised.
Related vulnerabilities
Recent vulnerabilities recorded for salt.
