Critical Shell Injection (CVE‑2020‑16846) in SaltStack Salt API Allows Unauthenticated Code Execution
What It Is — SaltStack Salt’s public API can be abused by an unauthenticated network‑connected attacker to inject shell commands that are executed via the SSH client. The flaw is a classic command‑injection (CWE‑78) that leads to remote code execution on the Salt master.
Exploitability — The vulnerability is exploitable without credentials; proof‑of‑concept code is publicly available. CVSS v3.1 base score 9.8 (Critical).
Affected Products — SaltStack Salt (any version exposing the Salt API).
Why It Matters for Trust & Control Assurance
- Continuous monitoring of API access logs provides the evidence needed to demonstrate that unauthenticated calls are being blocked.
- Hardened authentication and network segmentation of management interfaces satisfy a core control objective around privileged access, a signal that spans SOC 2, ISO 27001, NIST CSF 2.0 and others.
- Demonstrable remediation (patching, configuration hardening) creates a defensible audit trail that enterprise buyers increasingly demand before signing contracts.
Recommended Actions
- Apply SaltStack’s security patch for CVE‑2020‑16846 immediately.
- If the Salt API is not required, disable it or restrict it to trusted subnets.
- Enforce strong authentication (e.g., MFA, client certificates) on any exposed management API.
- Deploy continuous log collection and alerting for anomalous API calls.
- Validate the remediation through an independent configuration audit.
Source: CISA KEV – CVE‑2020‑16846