CVE-2020-11651VulnerabilityPublished 11/03/2021Updated 10/24/2026

CVE-2020-11651: SaltStack Salt Authentication Bypass Vulnerability

Affects SaltStack SaltSource CISA KEV

Severity

High

No CVSS score published yet

Exploitation: Actively exploited – in CISA KEV since 11/03/2021
KEV deadline: 05/03/2022
EPSS: 96.6% chance of exploitation in 30 days – higher than 99% of CVEs

What to do

CISA required action

Apply updates per vendor instructions.

nvd.nist.gov/vuln/detail/CVE-2020-11651 (opens in a new tab)

Description

CVE-2020-11651 is an authentication bypass vulnerability in the SaltStack Salt master process ClearFuncs. It allows remote attackers to access certain methods without authentication, potentially retrieving user tokens or executing commands on salt minions. Users following fundamental internet security best practices are not affected.

Summary

SaltStack Salt contains an authentication bypass vulnerability in the salt-master process ClearFuncs due to improper validation of method calls. This flaw enables remote attackers to bypass authentication and access some methods on the salt master, which can be leveraged to retrieve user tokens or execute commands on salt minions. The vulnerability has been exploited in the wild. No affected versions or patch information is provided in the input data.

Impact

Remote attackers can bypass authentication on the salt-master process, potentially leading to unauthorized retrieval of user tokens and remote command execution on salt minions. This compromises the confidentiality and integrity of the Salt infrastructure. However, users adhering to fundamental internet security guidelines are reportedly not affected.

Mitigation

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Users should verify their deployment follows fundamental internet security best practices as these reduce exposure to this vulnerability.

What to do

Description

AnalysisAI-generated, updated 10/24/2026, 08:56:12 UTC

References

Related threats