Live › vulnerability › CVE-2020-11651
Go to dashboardSaltStack Salt's salt-master ClearFuncs component does not validate method calls, so a remote user can call some methods without logging in. An attacker can retrieve user tokens from the salt master and run commands on salt minions.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 3h before NVD. All times on this page are UTC.
Apply updates per vendor instructions.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| SaltStack Salt | vendor | – | – |
Unknown from the sources. In the analyst’s queue.
Upgrade SaltStack Salt to a patched release per vendor instructions; exact fixed versions are not stated in the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
SaltStack Salt contains an authentication bypass vulnerability in the salt-master process ClearFuncs due to improperly validating method calls. The vulnerability allows a remote user to access some methods without authentication, which can be used to retrieve user tokens from the salt master and/or run commands on salt minions. Salt users who follow fundamental internet security guidelines and best practices are not affected by this vulnerability.
CISA required action: Apply updates per vendor instructions.
This page as .md · .json · in your agent: get_signal("CVE-2020-11651")
CISA KEV catalog, Creative Commons 0 · EPSS scores by FIRST, used with attribution · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.