{"id":"CVE-2020-16846","kind":"vulnerability","aliases":["CVE-2020-16846"],"related":[],"title":"SaltStack Salt: SaltStack Salt Shell Injection Vulnerability","description":"SaltStack Salt allows an unauthenticated user with network access to the Salt API to use shell injections to run code on the Salt API using the SSH client. This vulnerability affects any users running the Salt API.\n\nCISA required action: Apply updates per vendor instructions.","summary":"SaltStack Salt's Salt API passes unsanitized input to the SSH client, allowing shell injection. An unauthenticated attacker with network access to the Salt API can run arbitrary commands on the server.","severity":"critical","cvss":9.8,"epss":0.99585,"exploited":true,"exploited_at":"2021-11-03T00:00:00+00:00","products":[{"name":"SaltStack Salt","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","linux","package","salt","saltstack","self-hosted"],"not_affected_if":["no-network-exposure-of-salt-api","salt-api-not-running"],"how_to_check":"Check whether the Salt API service (salt-api) is running and reachable on the network, for example with 'systemctl status salt-api' and 'ss -ltnp | grep 8000'. Confirm the installed Salt version with 'salt --version'.","fix":"Upgrade Salt to a patched release per the vendor's instructions (version not stated in the sources). If the Salt API is not needed, stop and disable salt-api; otherwise restrict its network access.","status":"open","published_at":"2020-11-06T08:15:13+00:00","first_seen_at":"2026-10-23T19:11:53+00:00","triaged_at":"2026-10-23T21:41:39+00:00","updated_at":"2026-10-23T21:57:34+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-23T21:41:39Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade Salt to a patched release per the vendor's instructions (version not stated in the sources). If the Salt API is not needed, stop and disable salt-api; otherwise restrict its network access.","reach":"network","impact":"high","summary":"SaltStack Salt's Salt API passes unsanitized input to the SSH client, allowing shell injection. An unauthenticated attacker with network access to the Salt API can run arbitrary commands on the server.","category":"package","who_cares":["salt","saltstack","self-hosted","linux"],"confidence":0.8,"needs_auth":"no","worst_case":"Attacker runs arbitrary shell commands on the Salt master as the service user.","analyst_note":"Find the patched Salt versions and affected version range in the vendor advisory (SaltStack/SaltStack security notice for CVE-2020-16846) to fill in the fix and how_to_check fields.","how_to_check":"Check whether the Salt API service (salt-api) is running and reachable on the network, for example with 'systemctl status salt-api' and 'ss -ltnp | grep 8000'. Confirm the installed Salt version with 'salt --version'.","needs_analyst":true,"not_affected_if":["salt-api-not-running","no-network-exposure-of-salt-api"],"user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"critical"},"cost_usd":0.000523,"input_tokens":2842,"output_tokens":477,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-16846':10A,13A '-2020':9A,12A 'access':44B,64C 'action':95C 'affect':86C 'allow':36B,58C 'api':28B,48B,68C,79C,92C 'appli':96C 'arbitrari':51B 'attack':41B 'cisa':93C 'client':35B,83C 'code':75C 'command':52B 'cve':8A,11A 'exploit':16B 'host':23B 'inject':6A,38B,72C 'input':31B 'instruct':100C 'linux':17B 'network':43B,63C 'packag':18B 'pass':29B 'per':98C 'requir':94C 'run':50B,74C,89C 'salt':2A,4A,15A,19B,25B,27B,47B,57C,67C,78C,91C 'saltstack':1A,3A,14A,20B,24B,56C 'self':22B 'self-host':21B 'server':55B 'shell':5A,37B,71C 'ssh':34B,82C 'unauthent':40B,60C 'unsanit':30B 'updat':97C 'use':70C,80C 'user':61C,88C 'vendor':99C 'vulner':7A,85C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2020-11-06T08:15:13+00:00","kev":{"dateAdded":"2021-11-03","dueDate":"2022-05-03","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2020-16846","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-16846","severity":null,"published_at":"2021-11-03T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:53+00:00","fetched_at":"2026-10-25T16:39:50+00:00","note":null},{"source":"epss","external_id":"CVE-2020-16846","url":"https://api.first.org/data/v1/epss?cve=CVE-2020-16846","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:43+00:00","fetched_at":"2026-10-23T19:13:43+00:00","note":null},{"source":"nvd","external_id":"CVE-2020-16846","url":"https://nvd.nist.gov/vuln/detail/CVE-2020-16846","severity":null,"published_at":"2020-11-06T08:15:13+00:00","modified_at":"2026-06-17T02:58:07+00:00","first_seen_at":"2026-10-23T21:57:34+00:00","fetched_at":"2026-10-23T21:57:34+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}