Critical Authentication Bypass (CVE‑2020‑11651) in SaltStack Salt Threatens Configuration Management

Authentication Bypass in SaltStack Salt (CVE‑2020‑11651) Threatens Configuration Management

What It Is — SaltStack Salt’s salt‑master process contains an authentication bypass in the ClearFuncs module. Improper validation of method calls lets a remote user invoke privileged functions without authenticating.

Exploitability — Public proof‑of‑concept exists; CVSS v3.1 base score 9.8 (Critical). Exploitation requires network reachability to the master but no credentials.

Affected Products — SaltStack Salt (any version prior to the vendor‑released patch for CVE‑2020‑11651).

Why It Matters for Trust & Control Assurance

• Undermines the access‑control control objective that requires verified authentication before privileged actions.
• Highlights the need for continuous monitoring of authentication events to provide defensible audit evidence.
• Demonstrates that robust patch‑management and token‑rotation are essential evidence points for auditors and enterprise buyers.

Recommended Actions

• Apply SaltStack’s security update to the latest patched release.
• Rotate all master and minion authentication tokens immediately.
• Restrict network access to the salt‑master with segmentation or firewall rules.
• Enable detailed audit logging for privileged method calls and review logs for anomalous activity.

Source: CISA KEV – CVE‑2020‑11651