CVE-2022-22967: SaltStack Salt PAM Auth Bypass
Summary
CVE-2022-22967: Salt's PAM auth fails to reject locked accounts. Affects salt across 3 version ranges.
< 3002.9
>= 3003.0, < 3003.5
>= 3004.0, < 3004.2
Fixed in 3002.9, 3003.5 or 3004.2, depending on the release line you run. How to fix ↓
Also tracked for
- salt · Debian:10
The same CVE-2022-22967 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
SaltStack Salt is an open-source configuration management and remote execution tool. It allows administrators to manage and deploy software across a network of computers. The PAM (Pluggable Authentication Modules) auth module in SaltStack Salt is responsible for authenticating users using the PAM framework. This vulnerability affects versions before 3002.9, 3003.5, and 3004.2 of SaltStack Salt.
Vulnerability Detail
The PAM auth module in SaltStack Salt fails to reject locked accounts, allowing previously authorized users with locked accounts to still run Salt commands. This vulnerability affects both local shell accounts with an active session and salt-api users that authenticate via PAM eauth. An attacker with a locked account can continue to exploit the system and perform unauthorized actions, potentially leading to privilege escalation or unauthorized access to sensitive information.
How To Fix
Latest published version: 3008.3.0 as of 22 Oct 2026
pip install --upgrade "salt==3008.3.0"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 3002.93002.9pip install --upgrade "salt==3002.9" -
>= 3003.0, < 3003.53003.5pip install --upgrade "salt==3003.5" -
>= 3004.0, < 3004.23004.2pip install --upgrade "salt==3004.2"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, administrators can manually disable or lock the accounts of affected users until the SaltStack Salt upgrade can be performed. This can be done using the appropriate system administration tools and commands specific to the operating system in use.
Conclusion
The vulnerability in SaltStack Salt's PAM auth module allows locked accounts to bypass authentication and continue running Salt commands. It is crucial to upgrade to the patched versions of SaltStack Salt (3002.9, 3003.5, or 3004.2) to mitigate this vulnerability. Administrators can also temporarily disable or lock affected user accounts as a workaround. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for salt →
FAQ
SaltStack Salt is an open-source configuration management and remote execution tool used for managing and deploying software across a network of computers.
The PAM auth module in SaltStack Salt is responsible for authenticating users using the PAM (Pluggable Authentication Modules) framework.
This vulnerability allows previously authorized users with locked accounts to still run Salt commands, potentially leading to unauthorized actions and access to sensitive information.
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
You can use Vulert's playground (https://vulert.com/scanner) to check if your SaltStack Salt installation is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities without requiring access to the code or installation.
Related vulnerabilities
Recent vulnerabilities recorded for salt.
