CVSS 4.0
7.5 highCVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:NCVE-2025-62349
Salt contains an authentication protocol version downgrade weakness that can allow a malicious minion to bypass newer authentication/security features by using an older request payload format, enabling minion impersonation and circumventing protections introduced in response to prior issues.
Severity
CVSS 3.1
6.2 mediumCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:L- EPSS
- 0.5% chance of exploitation in the next 30 days; higher than 39% of CVEs (scores of 2026-10-31)
- CWE
- CWE-287
- Published
- Modified
- Record from
- the NVD, synced
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-vcf3-26xf-fw4m | PyPI | salt | >=3006.12 <3006.17 | 3006.17 |
| GHSA-vcf3-26xf-fw4m | PyPI | salt | >=3007.4 <3007.9 | 3007.9 |
| PYSEC-2026-1902 | PyPI | salt | >=3006.12 <3006.17 >=3007.4 <3007.9 | 3006.17, 3007.9 |