CVE-2022-22967: SaltStack Salt PAM Auth Bypass
Summary
CVE-2022-22967: An issue was discovered in SaltStack Salt in versions before 3002.9, 3003.5, 3004.2. Affects salt versions < 3002.9. Fixed in 3002.9. How to fix ↓
Also tracked for
- salt · Debian:10
The same CVE-2022-22967 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
SaltStack Salt is an open-source configuration management and remote execution framework. It is widely used for managing and automating infrastructure. The PAM (Pluggable Authentication Modules) auth module in SaltStack Salt is responsible for authenticating users via PAM. This vulnerability allows a previously authorized user with a locked account to still run Salt commands, bypassing the account lock. This affects both local shell accounts with an active session and salt-api users that authenticate via PAM eauth.
Vulnerability Detail
The issue arises from the failure of the PAM auth module to reject locked accounts. As a result, even if a user's account is locked, they can still execute Salt commands. This poses a security risk as locked accounts are typically intended to prevent user access. An attacker could exploit this vulnerability by leveraging a previously authorized user account with a locked status to perform unauthorized actions or gain elevated privileges. It is important to note that this vulnerability affects versions of SaltStack Salt prior to 3002.9, 3003.5, and 3004.2.
How To Fix
Latest published version: 3008.3.0 as of 22 Oct 2026
pip install --upgrade "salt==3008.3.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3002.9
This is the first release that contains the fix.
pip install --upgrade "salt==3002.9"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can manually modify the PAM configuration to explicitly reject locked accounts. This can be achieved by editing the relevant PAM configuration file (e.g., /etc/pam.d/salt) and adding the 'account required pam_deny.so' line before any other account-related lines. This modification will ensure that locked accounts are rejected during the authentication process. However, it is strongly recommended to apply the official fix by updating to a patched version of SaltStack Salt.
Conclusion
In conclusion, the CVE-2022-22967 vulnerability in SaltStack Salt allows users with locked accounts to bypass the account lock and execute Salt commands. It is crucial to update to the patched version or apply the provided workaround to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for salt →
FAQ
SaltStack Salt is an open-source configuration management and remote execution framework used for managing and automating infrastructure.
The PAM auth module in SaltStack Salt is responsible for authenticating users via PAM (Pluggable Authentication Modules).
This vulnerability allows a previously authorized user with a locked account to still run Salt commands, bypassing the account lock. It affects both local shell accounts with an active session and salt-api users that authenticate via PAM eauth.
The risk is that a user with a locked account can perform unauthorized actions or gain elevated privileges by leveraging this vulnerability.
To fix this vulnerability, update SaltStack Salt to version 3002.9 or later. Follow the official upgrade instructions or use the appropriate package manager to upgrade the package.
Related vulnerabilities
Recent vulnerabilities recorded for salt.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
