CVE-2020-11651: SaltStack Salt Authentication Bypass Vulnerability

CVE-2020-11651 is an authentication bypass in SaltStack Salt that affects the salt-master process. Improper validation of method calls in ClearFuncs can let a remote user reach certain methods without authenticating. That access can be abused to pull user tokens from the master and/or run commands on salt minions. Teams that expose Salt masters to untrusted networks face a direct path to control of managed systems; those who keep masters off the public internet and follow basic hardening practices are described as not affected. Confirm exact impact and fixed releases against the vendor advisory.

How it works

The flaw sits in the salt-master’s ClearFuncs handling: method calls are not validated tightly enough, so some functionality that should require authentication becomes reachable by an unauthenticated remote party. Once those methods are available, an attacker can obtain tokens held by the master and issue commands that the master then pushes to minions. In practical terms this is a classic authentication-bypass leading to unauthorized remote execution across the Salt estate. No further exploit mechanics, payloads, or version-specific behavior are stated in the provided record; treat any public proof-of-concept material as untrusted until you have verified it against the vendor’s own description.

Am I affected? How to find it in your systems

SaltStack Salt is commonly deployed as a configuration-management and remote-execution platform. The salt-master service is the central control plane; minions check in to it. Inventory every host that runs the master process, including lab, staging, and any cloud or containerized instances. Check whether the master’s management ports are reachable from untrusted networks—exposure is the primary risk factor called out by CISA. Review configuration and deployment records for Salt installations and compare running versions and patch levels to the fixed releases listed in the vendor advisory; do not rely on version numbers from secondary sources. On the master, examine logs for unexpected unauthenticated method calls, token retrieval activity, or command jobs that were not initiated by known administrators. Network telemetry showing connections to the master from unfamiliar sources, especially followed by sudden minion command activity, should be treated as suspicious. Because the CWE is not specified in the given facts, focus detection on the described ClearFuncs authentication gap rather than a generic weakness signature.

How to remediate

Apply the updates published by the vendor for SaltStack Salt exactly as instructed in the official advisory—this is the CISA-required action. After patching, restart the salt-master service in accordance with vendor guidance and verify that the previously exposed methods now require proper authentication. Re-validate that masters are not directly reachable from the internet and that only authorized management networks can connect. Rotate any tokens or credentials that could have been retrieved while the system was vulnerable, and review recent job history on minions for unauthorized commands. Document the versions you moved from and to so that future audits can confirm coverage.

If you can't patch immediately

Until the vendor update can be installed, reduce exposure aggressively. Segment the salt-master so that only trusted administrative subnets and minion networks can reach it; block all other ingress at the firewall or security group. If a web application firewall or reverse-proxy layer sits in front of any related management interface, apply temporary rules that restrict or alert on anomalous method-call patterns, understanding that virtual patching is only a partial control for this class of flaw. Disable any non-essential ClearFuncs-related or externally facing features if the product configuration allows it—confirm the exact knobs in the vendor documentation. Increase monitoring: alert on new connections to the master, unexpected token operations, and command jobs originating outside normal change windows. Maintain this posture only as a bridge to full patching; compensating controls do not remove the underlying authentication bypass.

If your data may have been exposed

Actively exploited authentication-bypass flaws in management planes frequently precede broader compromise of the systems those planes control. If your Salt master was reachable and unpatched during the window of exposure, assume tokens or command execution may have been abused and begin incident-response steps: isolate affected masters and minions, preserve logs, rotate credentials, and hunt for persistence. You can also run a free exposure scan of your email addresses against known breach data sets to see whether associated accounts have appeared in prior incidents while you complete the technical investigation.