CVE-2020-16846

saltstack salt, debian linux, fedoraproject fedora

Published 6 Nov 2020 · updated 17 Jun 2026 · Analyzed

9.8 Critical · CVSS 3.1, NVD

Exploited in the wild

CISA added this to its Known Exploited Vulnerabilities catalog on 3 Nov 2021, with a remediation deadline of 3 May 2022 for US federal agencies.

Required action: Apply updates per vendor instructions.

Description

An issue was discovered in SaltStack Salt through 3002. Sending crafted web requests to the Salt API, with the SSH client enabled, can result in shell injection.

References

lists.opensuse.org/opensuse-security-announce/2020-11/msg00029.html · Mailing List, Third Party Advisory
packetstormsecurity.com/files/160039/SaltStack-Salt-REST-API-Arbitrary-Command-Execution.html · Exploit, Third Party Advisory, VDB Entry
github.com/saltstack/salt/releases · Release Notes
lists.debian.org/debian-lts-announce/2020/12/msg00007.html · Mailing List, Third Party Advisory
lists.debian.org/debian-lts-announce/2022/01/msg00000.html · Mailing List, Third Party Advisory
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TPOGB2F6XUAIGFDTOCQDNB2VIXFXHWMA/ · Release Notes
security.gentoo.org/glsa/202011-13 · Third Party Advisory
www.debian.org/security/2021/dsa-4837 · Mailing List, Third Party Advisory
www.saltstack.com/blog/on-november-3-2020-saltstack-publicly-disclosed-three-new-cves/ · Broken Link, Vendor Advisory
www.zerodayinitiative.com/advisories/ZDI-20-1379/ · Third Party Advisory, VDB Entry
www.zerodayinitiative.com/advisories/ZDI-20-1380/ · Third Party Advisory, VDB Entry
www.zerodayinitiative.com/advisories/ZDI-20-1381/ · Third Party Advisory, VDB Entry
www.zerodayinitiative.com/advisories/ZDI-20-1382/ · Third Party Advisory, VDB Entry
www.zerodayinitiative.com/advisories/ZDI-20-1383/ · Third Party Advisory, VDB Entry
www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-16846 · US Government Resource