CVE-2022-22941: SaltStack Salt - Master-of-Masters Syndic Target Bypass
Summary
CVE-2022-22941: An issue was discovered in SaltStack Salt in versions before 3002.8, 3003.4, 3004.1. Affects salt versions < 3002.8. Fixed in 3002.8. How to fix ↓
Also tracked for
- salt · Debian:10
The same CVE-2022-22941 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
SaltStack Salt is an open-source configuration management and remote execution software. It allows administrators to manage and control a large number of servers and devices from a central location. The Master-of-Masters configuration enables a hierarchical structure where multiple Salt Masters can be connected to a central Master. The Syndic feature allows communication between the central Master and other Salt Masters. This vulnerability affects versions of SaltStack Salt prior to 3002.8, 3003.4, and 3004.1.
Vulnerability Detail
The vulnerability arises when a Master-of-Masters configuration is set up with a publisher_acl. If a user specified in the publisher_acl targets any minion connected to the Syndic, the Salt Master incorrectly interprets no valid targets as valid. This allows configured users to bypass permissions and execute commands on any minion connected to the Syndic. An attacker with access to a user account specified in the publisher_acl could exploit this vulnerability to gain unauthorized access to and control over any configured minion.
How To Fix
Latest published version: 3008.3.0 as of 22 Oct 2026
pip install --upgrade "salt==3008.3.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3002.8
This is the first release that contains the fix.
pip install --upgrade "salt==3002.8"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can disable the publisher_acl configuration on the Master-of-Masters. This can be done by removing or commenting out the publisher_acl configuration in the Salt Master configuration file. However, this workaround should only be considered as a temporary measure until the system can be upgraded to a patched version.
Conclusion
The vulnerability in SaltStack Salt versions prior to 3002.8, 3003.4, and 3004.1 allows unauthorized users to bypass permissions and execute commands on any minion connected to the Syndic. It is crucial to upgrade to the patched versions and review the publisher_acl configuration to mitigate the risk of unauthorized access. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for salt →
FAQ
SaltStack Salt is an open-source configuration management and remote execution software used for managing and controlling a large number of servers and devices.
A Master-of-Masters configuration in SaltStack Salt allows multiple Salt Masters to be connected to a central Master, creating a hierarchical structure for managing and controlling Salt minions.
The Syndic feature in SaltStack Salt enables communication between the central Master and other Salt Masters in a Master-of-Masters configuration.
publisher_acl is a configuration option in SaltStack Salt that specifies the users authorized to publish commands to minions.
This vulnerability allows unauthorized users specified in the publisher_acl to bypass permissions and execute commands on any minion connected to the Syndic. An attacker could exploit this to gain unauthorized access to and control over the affected minions.
Related vulnerabilities
Recent vulnerabilities recorded for salt.
