---
id: "CVE-2020-16846"
kind: "vulnerability"
aliases: ["CVE-2020-16846"]
title: "SaltStack Salt: SaltStack Salt Shell Injection Vulnerability"
severity: "critical"
cvss: 9.8
epss: 0.99585
exploited: true
status: "open"
category: "package"
products: [{"name": "SaltStack Salt", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["exploited", "linux", "package", "salt", "saltstack", "self-hosted"]
not_affected_if: ["no-network-exposure-of-salt-api", "salt-api-not-running"]
published_at: "2020-11-06T08:15:13+00:00"
first_seen_at: "2026-10-23T19:11:53+00:00"
updated_at: "2026-10-23T21:57:34+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-16846", "first_seen_at": "2026-10-23T19:11:53+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2020-16846", "first_seen_at": "2026-10-23T19:13:43+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-16846", "first_seen_at": "2026-10-23T21:57:34+00:00"}]
---

# SaltStack Salt: SaltStack Salt Shell Injection Vulnerability

SaltStack Salt's Salt API passes unsanitized input to the SSH client, allowing shell injection. An unauthenticated attacker with network access to the Salt API can run arbitrary commands on the server.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:SaltStack Salt affected ? fixed ?

## How to check

Check whether the Salt API service (salt-api) is running and reachable on the network, for example with 'systemctl status salt-api' and 'ss -ltnp | grep 8000'. Confirm the installed Salt version with 'salt --version'.

## Fix

Upgrade Salt to a patched release per the vendor's instructions (version not stated in the sources). If the Salt API is not needed, stop and disable salt-api; otherwise restrict its network access.

## Timeline

- 2026-10-23T19:11:53+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-16846
- 2026-10-23T19:13:43+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2020-16846
- 2026-10-23T21:57:34+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2020-16846

## From the sources

SaltStack Salt allows an unauthenticated user with network access to the Salt API to use shell injections to run code on the Salt API using the SSH client. This vulnerability affects any users running the Salt API.

CISA required action: Apply updates per vendor instructions.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_