CVE-2025-62349
Authentication Downgrade in Salt Enables Minion Impersonation
Publication date: 2026-01-30
Last updated on: 2026-01-30
Assigner: VMware
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| saltproject | salt | 3007.9 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-287 | When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is an authentication protocol version downgrade weakness in Salt. It allows a malicious minion to bypass newer authentication and security features by using an older request payload format. This enables the attacker to impersonate a minion and circumvent protections that were introduced to address previous security issues. [1]
How can this vulnerability impact me? :
The vulnerability can impact you by allowing a malicious minion to impersonate legitimate minions, bypassing enhanced authentication and security features. This could lead to unauthorized access, data compromise, or manipulation of Salt-managed systems, potentially undermining the integrity and security of your infrastructure. [1]
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, upgrade Salt to version 3007.9 or later, which includes a security fix for CVE-2025-62349. After upgrading the master, configure the `minimum_auth_version` option in the master configuration to enforce a minimum authentication protocol version of 3 or higher. If you have older minions that do not support protocol version 3, temporarily set `minimum_auth_version: 0` before upgrading the master, then upgrade all minions, and finally remove this override to enforce the new minimum version. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
To detect this vulnerability, you should check the Salt master configuration for the 'minimum_auth_version' setting. If it is not set to 3 or higher, your system may be vulnerable to authentication protocol version downgrade attacks. There are no specific commands provided in the resources to detect exploit attempts on the network or system. However, verifying the configuration can be done by inspecting the Salt master config file, typically located at /etc/salt/master, for the 'minimum_auth_version' parameter. Setting 'minimum_auth_version: 3' enforces the use of authentication protocol version 3 or higher, mitigating the vulnerability. If you have older minions, you may temporarily set 'minimum_auth_version: 0' during upgrades. No direct network detection commands or signatures are provided in the available resources. [1]