CVE-2021-21996: Resource Exposure to Wrong Sphere in salt
Summary
CVE-2021-21996: Exposure of Resource to Wrong Sphere in salt. Affects salt versions < 3003.3. Fixed in 3003.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
SaltStack Salt is an open-source configuration management and remote execution software. It is widely used for managing and automating the configuration of servers and network devices. The vulnerability identified as CVE-2021-21996 allows a user with control of the source and source_hash URLs to gain full file system access as root on a salt minion.
Vulnerability Detail
The vulnerability arises from a flaw in SaltStack Salt versions before 3003.3. An attacker who can manipulate the source and source_hash URLs can exploit this issue to gain unauthorized access to the file system of a salt minion. This can lead to complete control over the affected system, potentially resulting in data breaches, unauthorized modifications, or disruption of services.
How To Fix
Latest published version: 3008.3.0 as of 22 Oct 2026
pip install --upgrade "salt==3008.3.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3003.3
This is the first release that contains the fix.
pip install --upgrade "salt==3003.3"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the official fix by upgrading to the patched version of SaltStack Salt.
Conclusion
The vulnerability CVE-2021-21996 in SaltStack Salt exposes resources to the wrong sphere, allowing an attacker to gain full file system access as root on a salt minion. It is crucial to upgrade to the patched version (3003.3 or later) to mitigate this vulnerability and ensure the security of your systems. For further support and assistance in vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for salt →
FAQ
SaltStack Salt is an open-source configuration management and remote execution software used for managing and automating the configuration of servers and network devices.
The vulnerability allows an attacker to gain full file system access as root on a salt minion, potentially leading to unauthorized modifications, data breaches, or disruption of services.
To fix this vulnerability, it is recommended to upgrade to SaltStack Salt version 3003.3 or later.
No, there is no known workaround for this vulnerability. It is crucial to apply the official fix by upgrading to the patched version of SaltStack Salt.
For more information about this vulnerability, you can refer to the CVE-2021-21996 advisory or consult the official documentation and support channels of SaltStack Salt.
Related vulnerabilities
Recent vulnerabilities recorded for salt.
