CVE-2025-22236: 
Python vulnerability analysis and mitigation

CVE-2025-22236 is a minion event bus authorization bypass vulnerability in SaltStack (Salt) that allows an attacker with access to a minion key to craft a malicious message capable of executing jobs on other minions. It affects Salt versions 3006.0–3006.11 and 3007.0–3007.3, with the lateral execution capability specifically noted for versions >= 3007.0. The vulnerability was published on June 13, 2025, and carries a CVSS v3.1 base score of 8.1 (High) (GitHub Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-287 (Improper Authentication) — the Salt minion event bus fails to sufficiently validate the identity or authorization scope of messages received from minion keys, allowing a crafted message to be accepted as legitimate by other minions. An attacker who has obtained a valid minion key can forge event bus messages that bypass authorization checks and trigger job execution on minions other than the one associated with the compromised key. The attack vector is local (requiring prior access to a minion key), with low attack complexity and no user interaction required, but the scope change indicates cross-minion impact beyond the initially compromised component (GitHub Advisory, Red Hat Bugzilla).

Successful exploitation allows an authenticated attacker holding a minion key to execute unauthorized jobs across other minions in the Salt infrastructure, resulting in high confidentiality and integrity impact and low availability impact. This enables potential lateral movement throughout the entire Salt-managed environment, unauthorized access to sensitive configuration data or secrets managed by Salt, and modification of system state on multiple minions. The changed scope means a single compromised minion key can be leveraged to affect resources well beyond the initially compromised system (GitHub Advisory).

As of the time of disclosure, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (GitHub Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.014–0.16%, placing it in the 34th percentile for exploitation likelihood within 30 days. Exploitation requires prior access to a minion key, which limits opportunistic exploitation but remains a realistic threat in environments with weak key management practices.

1. Obtain a minion key: Gain access to a Salt minion's private key through credential theft, compromise of a minion host, or insider access — this is the primary prerequisite for exploitation.
2. Identify target minions: Enumerate other minions connected to the same Salt master by inspecting Salt event bus traffic or configuration files accessible from the compromised minion.
3. Craft a malicious event bus message: Using the obtained minion key, construct a forged Salt event bus message that impersonates a legitimate job request, bypassing the authorization checks that should restrict the key's scope to its own minion.
4. Inject the crafted message: Publish the forged message to the Salt event bus, targeting one or more other minions (applicable to Salt >= 3007.0 where the bypass is confirmed effective).
5. Achieve cross-minion job execution: The targeted minions accept and execute the forged job, allowing the attacker to run arbitrary Salt commands, exfiltrate data, modify configurations, or establish persistence across the Salt infrastructure (GitHub Advisory, Red Hat Bugzilla).

• Logs: Salt master logs showing job executions originating from a minion ID that does not match the expected source for that job type; unexpected salt-minion event bus messages with mismatched minion IDs or unusual job targets in /var/log/salt/master.
• Process: Unexpected processes spawned by salt-minion on hosts that should not have received a particular job; Salt job execution records (/var/cache/salt/minion/proc/) showing jobs not initiated by the Salt master directly.
• Network: Unusual Salt event bus traffic (ZeroMQ, default port 4505/4506) between minions or from a minion to the master at unexpected times; connections from minion IPs to the Salt master event bus outside of normal polling intervals.
• File System: New or modified files on minion hosts resulting from unauthorized Salt state applications; unexpected changes to Salt pillar data or configuration files managed by Salt.

Salt has released patched versions addressing this vulnerability: update to Salt 3006.12 (for the 3006.x branch) or Salt 3007.4 (for the 3007.x branch) as the primary remediation (GitHub Advisory). As interim measures, restrict and closely monitor access to minion keys, implement strict access controls for Salt infrastructure, audit existing minion configurations for unauthorized key exposure, and monitor Salt event bus activity for anomalous job executions. Fedora, SUSE, and other Linux distributions have also released updated Salt packages incorporating these fixes.

Red Hat tracked the vulnerability via Bugzilla with a high severity/priority rating and assigned it to their Product Security DevOps Team (Red Hat Bugzilla). The Secret CISO newsletter included CVE-2025-22236 in its June 14, 2025 edition highlighting Dell and Salt vulnerabilities requiring urgent patches. Multiple Linux distributions including Fedora, SUSE (openSUSE Tumbleweed, SUSE Multi-Linux Manager), and others issued security advisories and updated packages in the weeks following disclosure. Tenable added detection coverage via multiple Nessus plugins shortly after the CVE was published.