CVE-2020-16846: SaltStack Salt Shell Injection Vulnerability

CVE-2020-16846 is a shell injection vulnerability in SaltStack Salt that lets an unauthenticated attacker with network reach to the Salt API execute code on the Salt API host through the SSH client. It matters because any environment running the Salt API is in scope: successful abuse can give an outsider control over the management plane that orchestrates configuration and commands across your infrastructure.

Defenders should treat exposure of the Salt API as high priority until the vendor update is applied and confirmed. Specifics such as exact affected releases must be checked against the vendor advisory.

How it works

The weakness is CWE-78 (OS command injection). SaltStack Salt’s Salt API accepts input that is later passed to the SSH client without adequate sanitization. An unauthenticated user who can reach the API over the network can craft requests that inject shell metacharacters, causing the API process to execute attacker-chosen commands in the context of the Salt API service.

No authentication is required; network access alone is sufficient. The result is arbitrary code execution on the host running the Salt API. Exact request formats and parameters are not detailed here; consult the vendor advisory for the precise attack surface.

Am I affected? How to find it in your systems

SaltStack Salt is commonly deployed as a configuration-management and remote-execution platform. The Salt API component is often exposed on management networks or, less securely, on broader internal or external interfaces. Any installation that runs the Salt API is potentially affected.

Inventory steps:

• Search configuration-management databases, package inventories, and container images for Salt master or Salt API packages and services.
• Identify hosts listening on the ports normally used by the Salt API and confirm whether the API service is enabled.
• Review network diagrams and firewall rules for any path that allows unauthenticated clients to reach those listeners.
• Compare installed versions and configurations against the vendor advisory to determine whether the release is vulnerable.

Telemetry signs of exploitation are typical of command-injection activity: unexpected child processes spawned by the Salt API service, unusual SSH client invocations originating from the API process, or anomalous API request patterns in access logs. Correlate these with external connection attempts to the API endpoint. Absence of such logs does not prove safety; many environments do not log the necessary detail by default.

How to remediate

Apply the updates supplied by the vendor exactly as described in the official advisory. CISA’s required action is to apply updates per vendor instructions. After patching, restart the Salt API service and verify the new version is running.

Additional hardening for this class of flaw:

• Ensure the Salt API is not reachable from untrusted networks; bind it only to management interfaces.
• Enforce authentication and least-privilege credentials for any remaining API access.
• Run the Salt API process under a dedicated, low-privilege account and apply OS-level controls that limit what the process can execute.
• Review and tighten any SSH-related configuration used by Salt so that injected arguments cannot escalate further.

If you can't patch immediately

Until the vendor update can be installed, reduce exposure with compensating controls:

• Segment the Salt API behind strict network controls so that only explicitly authorized management hosts can reach it; block all other sources.
• If a web application firewall or reverse proxy sits in front of the API, apply virtual-patching rules that reject requests containing shell metacharacters or unexpected argument patterns; tune and test these rules to avoid breaking legitimate automation.
• Temporarily disable the Salt API service if operational needs allow, or disable the SSH-client functionality that the vulnerability abuses, confirming the impact with your Salt administrators.
• Increase monitoring: alert on new processes spawned by the Salt API user, on outbound SSH connections initiated by that process, and on anomalous API traffic volume or source addresses.

These measures lower risk but do not eliminate it; schedule the official patch as soon as possible.

If your data may have been exposed

Actively exploited management-plane vulnerabilities frequently lead to follow-on compromise and data exposure. If you have evidence of exploitation or simply want to check whether credentials or addresses tied to your organization already appear in known breach data, run a free exposure scan of your email addresses against published breach corpora. Rotate any Salt or infrastructure credentials that may have been accessible from the affected host, and continue incident-response investigation according to your internal procedures. Ransomware use specifically tied to this CVE is not documented in the provided facts.