CVE-2020-25592
CriticalPublic exploitSaltStack Salt Improper Validation of eauth credentials and tokens in salt-netapi
Published May 24, 2022 · Updated Jul 8, 2026 · Also known as GHSA-29j3-2446-5j4w, PYSEC-2020-106, UBUNTU-CVE-2020-25592
Key Facts
Patch immediately- CVE-2020-25592 is a critical-severity vulnerability (CVSS 9.8 v3.1) affecting Salt (Saltstack), Debian Linux, bind-formula (suse) and 22 more products.
- It is not listed in any known-exploited vulnerabilities catalog. Public exploit code is available.
- EPSS estimates a 57% probability of exploitation in the next 30 days.
- Fixed versions are available, including bind-formula 0.1.1603299886.60e4bcf-3.3.2, cobbler 2.2.2-0.68.12.1, grafana-formula 0.3.0-3.3.2.
- Brandefense priority: patch immediately, because it is very likely to be exploited soon.
CVSS v3.1
9.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS (30-day exploit likelihood)
57%
Higher than 99.0% of all scored CVEs
Exploited in the wild
No known
Not in a known-exploited catalog
Public exploit code
Available
Proof-of-concept or weaponized module
Get the full CVE-2020-25592 brief as a PDF
Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.
Description
In SaltStack Salt through 3002, salt-netapi improperly validates eauth credentials and tokens. A user can bypass authentication and invoke Salt SSH.
Affected Products
530 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| SaltSaltstack | 3001 | 2015.8.10 |
| Debian LinuxDebian | 10.0, 9.0 | n/a |
| bind-formulasuse | See advisory | 0.1.1603299886.60e4bcf-3.3.2 |
| cobblersuse | See advisory | 2.2.2-0.68.12.1 |
| grafana-formulasuse | See advisory | 0.3.0-3.3.2 |
Patched Releases
bind-formula
0.1.1603299886.60e4bcf-3.3.2
cobbler
2.2.2-0.68.12.1
grafana-formula
0.3.0-3.3.2
image-sync-formula
0.1.1602150122.f08af0a-3.6.2
koan
2.2.2-0.68.12.1
mgr-daemon
4.1.3-2.6.3, 4.1.3-5.20.1
prometheus-exporters-formula
0.8.0-3.16.2
prometheus-formula
0.3.0-3.3.1
pxe-formula
0.1.1602490840.4f32148-3.3.2
py26-compat-salt
2016.11.10-10.17.1, 2016.11.10-6.3.3, 2016.11.10-6.41.1
python-distro
1.5.0-3.5.1
python-susemanager-retail
1.0.1602150122.f08af0a-3.3.2
python2-distro
1.5.0-3.5.1
python2-salt
3000-4.20.1, 3000-46.114.1, 3000-5.91.1, 3000-6.51.1, 3000-lp151.5.30.1, 3000-lp152.3.15.1
python2-spacewalk-check
4.1.7-27.38.1
python2-spacewalk-client-setup
4.1.7-27.38.1
python2-spacewalk-client-tools
4.1.7-27.38.1
python3-distro
1.5.0-3.5.1
python3-salt
3000-4.20.1, 3000-46.114.1, 3000-5.91.1, 3000-6.51.1, 3000-lp151.5.30.1, 3000-lp152.3.15.1, 3002.2-37.1, 3002.2-6.1, 3002.2-lp152.3.36.1
python3-spacewalk-check
4.1.7-4.6.4
python3-spacewalk-client-setup
4.1.7-4.6.4
python3-spacewalk-client-tools
4.1.7-4.6.4
python3-susemanager-retail
1.0.1602150122.f08af0a-3.3.2
Salt
2015.8.10, 2015.8.13, 2015.8.8+ds-1ubuntu0.1+esm2, 2016.11.10, 2016.11.10-43.63.1, 2016.11.2+ds-1+deb9u6, 2016.11.3, 2016.11.4-48.13.1, 2016.11.6, 2016.3.4, 2016.3.6, 2016.3.8, 2017.7.4, 2017.7.4+dfsg1-1ubuntu18.04.2+esm1, 2017.7.8, 2018.3.4+dfsg1-6+deb10u2, 2018.3.5, 2019.2.5, 2019.2.7, 2019.2.7-1, 3000-4.20.1, 3000-46.114.1, 3000-5.91.1, 3000-6.51.1, 3000-lp151.5.30.1, 3000-lp152.3.15.1, 3000.3, 3000.5, 3001.3, 3002-r1, 3002.1, 3002.2-37.1, 3002.2-6.1, 3002.2-lp152.3.36.1
salt-api
2016.11.4-48.13.1, 3000-4.20.1, 3000-46.114.1, 3000-5.91.1, 3000-6.51.1, 3000-lp151.5.30.1, 3000-lp152.3.15.1, 3002.2-37.1, 3002.2-6.1, 3002.2-lp152.3.36.1
Timeline
Publicly disclosed
May 24, 2022
Last updated
Jul 8, 2026
Weakness Type
- CWE-20 Improper Input Validation
- CWE-287 Improper Authentication
References
- advisoryhttps://bugzilla.suse.com/1144447
- advisoryhttps://bugzilla.suse.com/1159670
- advisoryhttps://bugzilla.suse.com/1167907
- advisoryhttps://bugzilla.suse.com/1169664
- advisoryhttps://bugzilla.suse.com/1171257
FAQ
Common Questions.
In SaltStack Salt through 3002, salt-netapi improperly validates eauth credentials and tokens.
Affected: Salt (Saltstack) versions 3001; Debian Linux versions 10.0, 9.0; bind-formula (suse), among others. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
Public exploit code is available.
Fixed versions are available, including bind-formula 0.1.1603299886.60e4bcf-3.3.2, cobbler 2.2.2-0.68.12.1, grafana-formula 0.3.0-3.3.2.
Brandefense priority: patch immediately, because it is very likely to be exploited soon.
Is CVE-2020-25592 Running On Your Attack Surface?
Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.
Request A Demo