CVE-2025-62349: Salt Package Authentication Protocol Downgrade Vulnerability
Summary
CVE-2025-62349: Salt Authentication Protocol Version Downgrade Allows Minion Impersonation. Affects salt across 2 version ranges.
>= 3006.12, < 3006.17
>= 3007.4, < 3007.9
Fixed in 3006.17 or 3007.9, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Salt is an open-source configuration management and orchestration tool that enables users to manage and automate the deployment of software and infrastructure. It allows for remote execution of commands and configuration management across multiple systems. The package is widely used for its scalability and flexibility in managing large infrastructures. However, it has a vulnerability that affects its authentication protocol, which could lead to security breaches.
Vulnerability Detail
The vulnerability in Salt arises from an authentication protocol version downgrade weakness. This flaw allows a malicious minion to exploit older request payload formats to bypass newer security features. By doing so, the attacker can impersonate legitimate minions and circumvent the protections that were introduced to address previous security issues. This could lead to unauthorized access and control over the systems managed by Salt, posing significant risks to the integrity and confidentiality of the data.
How To Fix
Latest published version: 3008.3.0 as of 22 Oct 2026
pip install --upgrade "salt==3008.3.0"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 3006.12, < 3006.173006.17pip install --upgrade "salt==3006.17" -
>= 3007.4, < 3007.93007.9pip install --upgrade "salt==3007.9"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, users can implement stricter network controls to limit the exposure of Salt minions to untrusted sources. Additionally, monitoring for unusual authentication requests can help mitigate the risk until the package is updated.
Conclusion
The Salt package has a significant vulnerability that can lead to minion impersonation through authentication protocol downgrades. It is crucial for users to update to the latest patched versions to protect their systems from potential threats. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for salt →
FAQ
CVE-2025-62349 is a vulnerability in the Salt package that allows for authentication protocol downgrades, enabling minion impersonation.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
The risks include unauthorized access to systems managed by Salt, potential data breaches, and the ability for attackers to execute commands as legitimate minions.
You can update the Salt package by running the command 'pip install --upgrade salt' in your terminal.
If immediate updates are not possible, consider implementing stricter network controls and monitoring authentication requests to mitigate risks.
References
Related vulnerabilities
Recent vulnerabilities recorded for salt.
