ACTIVELY EXPLOITED
CVE-2020-11652: SaltStack Salt Path Traversal Vulnerability
| Vendor | SaltStack |
|---|---|
| Product | Salt |
| Actively exploited | Yes |
| Added to CISA KEV | 3 Nov 2021 |
| CISA federal deadline | 3 May 2022 |
| Weakness (CWE) | CWE-22 |
Required action (CISA's text)
Apply updates per vendor instructions.
Description (NVD)
SaltStack Salt contains a path traversal vulnerability in the salt-master process ClearFuncs which allows directory access to authenticated users. Salt users who follow fundamental internet security guidelines and best practices are not affected by this vulnerability.
SOURCES
Other SaltStack flaws
- CVE-2020-16846: SaltStack Salt Shell Injection Vulnerability
- CVE-2020-11651: SaltStack Salt Authentication Bypass Vulnerability
Data from NVD, CISA KEV, FIRST EPSS and vendor advisories. Updated 10 Nov 2026.