CVE-2021-22004: SaltStack Salt before 3003.3 - Malicious Actor Subversion
Summary
CVE-2021-22004: An issue was discovered in SaltStack Salt before 3003.3. Affects salt versions < 3003.3. Fixed in 3003.3. How to fix ↓
Also tracked for
- salt · Debian:11
The same CVE-2021-22004 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
SaltStack Salt is an open-source configuration management and remote execution software. It allows administrators to manage and automate the configuration of multiple systems. The software consists of a master server and minion agents that run on the target systems. The minion installer in SaltStack Salt accepts and uses a minion config file located at C:\salt\conf if it exists before the installer is run. This behavior can be exploited by a malicious actor to manipulate the minion software's intended functionality.
Vulnerability Detail
The vulnerability (CVE-2021-22004) in SaltStack Salt before version 3003.3 allows an attacker to subvert the proper behavior of the minion software. By placing a malicious minion config file at C:\salt\conf before running the installer, an attacker can control the configuration of the minion agent on the target system. This can lead to unauthorized access, privilege escalation, or other malicious activities on the compromised system.
How To Fix
Latest published version: 3008.3.0 as of 22 Oct 2026
pip install --upgrade "salt==3008.3.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3003.3
This is the first release that contains the fix.
pip install --upgrade "salt==3003.3"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a workaround, users can remove or rename the C:\salt\conf file before running the minion installer. This ensures that the installer will not use any existing config file and will generate a new one with default settings. However, this workaround may require additional configuration after the installation to properly set up the minion agent.
Conclusion
The vulnerability (CVE-2021-22004) in SaltStack Salt before version 3003.3 allows a malicious actor to subvert the proper behavior of the minion software. Users should upgrade to the latest version of SaltStack Salt to mitigate this vulnerability. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for salt →
FAQ
SaltStack Salt is an open-source configuration management and remote execution software used for managing and automating the configuration of multiple systems.
This vulnerability allows a malicious actor to manipulate the configuration of the SaltStack Salt minion agent, potentially leading to unauthorized access, privilege escalation, or other malicious activities on the compromised system.
To fix this vulnerability, users should upgrade to SaltStack Salt version 3003.3 or later. This version includes a fix that prevents the minion installer from accepting and using a minion config file at C:\salt\conf.
Yes, users can remove or rename the C:\salt\conf file before running the minion installer to prevent it from using any existing config file. However, additional configuration may be required after the installation.
For more information about this vulnerability, you can refer to the official SaltStack advisory at https://github.com/pypa/advisory-database/blob/main/vulns/salt/PYSEC-2021-346.yaml
Related vulnerabilities
Recent vulnerabilities recorded for salt.
