SALT vulnerabilities

2 known vulnerabilities in SALT from VMware. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.1 High severity

  SALT: Improper Authorization

  CVE-2025-22239Jun 13, 2025VMware

  Arbitrary event injection on Salt Master. The master's "_minion_event" method can be used by and authorized minion to send arbitrary events onto the master's event bus.

• 8.1 High severity

  SALT: Improper Authentication

  CVE-2025-22236Jun 13, 2025VMware

  Minion event bus authorization bypass. An attacker with access to a minion key can craft a message which may be able to execute a job on other minions (>= 3007.0).