CVE-2025-22236: Minion Event Bus Auth Bypass Vulnerability

CVE-2025-22236 Overview

CVE-2025-22236 is an authorization bypass vulnerability in the Salt Project Minion event bus. An attacker who holds a valid minion key can craft an event bus message that triggers job execution on other minions managed by the same master. The flaw affects Salt versions >= 3007.0 and is tracked under CWE-287 (Improper Authentication). Because Salt is widely used for infrastructure automation, a single compromised minion can be leveraged to pivot laterally across the fleet.

Critical Impact
A single compromised minion key can be abused to execute arbitrary Salt jobs on other minions, expanding the blast radius from one host to the entire managed environment.

Affected Products

Salt Project (SaltStack) versions >= 3007.0
Salt 3006.x branch prior to 3006.12
Salt 3007.x branch prior to 3007.4

Discovery Timeline

2025-06-13 - CVE-2025-22236 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-22236

Vulnerability Analysis

Salt uses an event bus to distribute jobs, state runs, and orchestration messages between the master and its minions. Authorization on this bus determines which principals can publish messages that trigger job execution. In affected releases, the authorization check does not adequately validate the origin and scope of certain crafted event messages sent by an authenticated minion.

As a result, a party that possesses a legitimate minion key can publish an event that the master or peer minions interpret as a valid job dispatch. Because the attack is issued from a local, authenticated position on the Salt transport, it changes scope: activity originating on one minion can influence execution on others, breaking the trust boundary that isolates individual minions.

The vulnerability is classified under CWE-287 because the root problem is authentication and authorization enforcement on inbound event bus messages, not input validation of a specific payload.

Root Cause

The Salt event bus authorization logic in the 3007.x code path treats certain messages published by an authenticated minion as trusted for cross-minion job routing. The check does not verify that the sending minion is authorized to target other minions, allowing a crafted message to bypass the intended per-minion scope enforcement.

Attack Vector

Exploitation requires local access to the Salt transport with a valid minion key, which corresponds to a high-privilege prerequisite. Given that condition, the attacker publishes a specifically crafted event bus message. The master accepts the message and dispatches the embedded job to other minions, allowing the attacker to run Salt modules on systems they do not directly control.

No verified public exploit code is available. Refer to the Salt Project Release Notes 3007.4 and Salt Project Release Notes 3006.12 for the patched behavior.

Detection Methods for CVE-2025-22236

Indicators of Compromise

Unexpected salt.job or salt/job/* events on the master that originate from a minion rather than the master or a peer publisher.
Salt jobs executed on minions where the requesting user or _stamp metadata does not match a legitimate scheduler, runner, or authorized peer.
Divergence between jobs recorded in the master's job cache and jobs actually initiated by administrators.

Detection Strategies

Audit Salt master logs (/var/log/salt/master) for event publishes carrying job payloads whose source minion identity does not align with expected orchestration flows.
Correlate minion-side execution of cmd.run, state.apply, or module calls with the originating publisher recorded in the master job cache.
Alert on any minion attempting to publish events matching salt/job/*/new tags, which should typically be produced by the master.

Monitoring Recommendations

Forward Salt master and minion logs to a centralized analytics platform and baseline normal job publish behavior per environment.
Track the inventory of accepted minion keys and alert on new key acceptances outside of change windows.
Monitor process execution on minions for Salt-triggered commands that do not correspond to a sanctioned pillar, schedule, or runner.

How to Mitigate CVE-2025-22236

Immediate Actions Required

Upgrade Salt masters and minions to 3006.12, 3007.4, or later per the vendor release notes.
Rotate and re-accept minion keys after patching to invalidate any keys that may have been staged for abuse.
Restrict network access to the Salt master publish and return ports (4505/tcp, 4506/tcp) so only trusted management networks can reach the transport.

Patch Information

Salt Project addressed the authorization bypass in the 3006.12 and 3007.4 releases. Details are documented in the Salt Project Release Notes 3006.12 and the Salt Project Release Notes 3007.4. Apply the patched release to both masters and minions, since minions on the vulnerable branch remain exposed even when the master is upgraded.

Workarounds

Enforce least-privilege on minion hosts to reduce the likelihood of a minion key being stolen by a local attacker.
Where possible, segment high-value minions onto a dedicated master so a compromised low-value minion cannot target sensitive systems.
Review and tighten peer and peer_run configuration in the master config to limit which minions may invoke functions against peers until patching is complete.

bash

# Configuration example: restrict peer publishing on the Salt master
# /etc/salt/master.d/peer.conf
peer: {}
peer_run: {}

# Then upgrade and restart
sudo salt '*' test.ping
sudo yum update salt-master salt-minion    # or apt / pip per platform
sudo systemctl restart salt-master
sudo salt '*' cmd.run 'systemctl restart salt-minion'