CVE-2020-16846VulnerabilityPublished 11/03/2021Updated 10/24/2026

CVE-2020-16846: SaltStack Salt Shell Injection Vulnerability

Affects SaltStack SaltSource CISA KEV

Severity

High

No CVSS score published yet

Exploitation: Actively exploited – in CISA KEV since 11/03/2021
KEV deadline: 05/03/2022
EPSS: 99.6% chance of exploitation in 30 days – higher than 99% of CVEs

What to do

CISA required action

Apply updates per vendor instructions.

nvd.nist.gov/vuln/detail/CVE-2020-16846 (opens in a new tab)

Description

CVE-2020-16846 is a high-severity vulnerability in SaltStack Salt that allows an unauthenticated attacker with network access to the Salt API to execute arbitrary code via shell injection through the SSH client. This affects any deployment running the Salt API and has been exploited in the wild.

Summary

SaltStack Salt contains a shell injection vulnerability (CWE-78) identified as CVE-2020-16846. An unauthenticated attacker with network access to the Salt API can exploit this flaw by injecting shell commands through the SSH client interface, enabling remote code execution on the Salt API server. This vulnerability affects all users running the Salt API component of SaltStack Salt. Exploitation has been observed in the wild, indicating active threat actor interest.

Impact

Successful exploitation allows unauthenticated remote attackers to execute arbitrary code on the Salt API server, potentially leading to full system compromise. This can result in unauthorized control over affected infrastructure managed by SaltStack Salt.

Mitigation

No explicit patch or remediation details are provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is applied, restrict network access to the Salt API to trusted sources only and monitor for suspicious activity targeting this interface.

Weaknesses

CWE-78OS Command Injection (opens in a new tab)

What to do

Description

AnalysisAI-generated, updated 10/24/2026, 08:56:10 UTC

Weaknesses

References

Related threats