CVE-2025-22239: Salt Master Auth Bypass Vulnerability

CVE-2025-22239 Overview

CVE-2025-22239 is an authorization flaw in the Salt Project's Salt Master component. An authorized minion can invoke the master's _minion_event method to inject arbitrary events onto the master's event bus. Because the Salt event bus drives reactor logic, orchestration, and job returns, injected events can trigger unintended state changes across managed infrastructure. The weakness is classified under CWE-285: Improper Authorization.

Critical Impact
An authenticated minion can push forged events to the master, potentially triggering reactor-driven actions, tampering with job data, or escalating influence over other minions managed by the same master.

Affected Products

Salt Project salt versions prior to 3006.12
Salt Project salt versions prior to 3007.4
Salt Master deployments accepting minion connections on the event bus

Discovery Timeline

2025-06-13 - CVE-2025-22239 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-22239

Vulnerability Analysis

Salt is an event-driven configuration management and remote execution framework. The Salt Master maintains an internal event bus that reactors, runners, and returners subscribe to. Minions communicate with the master through authenticated channels and can fire events tied to their own identity.

The master exposes a _minion_event handler intended to accept events originating from a specific minion. The handler does not sufficiently constrain the event tag or payload contents that a minion is allowed to publish. An authorized minion can therefore emit events on tags that impersonate other minions, mimic system-level events, or trigger reactor matchers configured on the master.

Because reactor rules commonly execute privileged actions in response to event tags, arbitrary event injection can cascade into command execution against other minions, disruption of orchestration state, or falsification of job return data recorded by the master.

Root Cause

The root cause is improper authorization in _minion_event on the master. The method treats an authenticated minion as authoritative for any event tag or data structure it submits, rather than restricting the minion to events scoped to its own identity.

Attack Vector

Exploitation requires network access to the master's minion channel and possession of an accepted minion key. A compromised or malicious minion sends a crafted event payload through the standard minion transport. The master accepts the payload and republishes it on the internal event bus, where reactors and other consumers act on it as if it were legitimate.

No verified public exploit code is available. Refer to the Salt Project 3006.12 release notes and Salt Project 3007.4 release notes for vendor technical details.

Detection Methods for CVE-2025-22239

Indicators of Compromise

Salt master event bus entries where the event tag references a minion ID that does not match the publishing minion's authenticated identity
Unexpected reactor executions correlated with events fired from a single minion in a short time window
Job returns appearing on the master for jobs that were never dispatched through the standard salt or salt-run interfaces
Anomalous salt/minion/*/start or salt/auth style events originating from an already-connected minion

Detection Strategies

Enable and centralize Salt master logs at debug or info level and parse events published via _minion_event for tag or ID mismatches
Audit reactor configurations and log every reactor invocation with the source event tag and originating minion
Baseline normal event volumes per minion and alert on sudden spikes or events using system-reserved tag prefixes

Monitoring Recommendations

Forward Salt master logs and event bus data to a centralized SIEM or data lake for correlation across minions
Alert when a minion publishes events whose embedded id field differs from its authenticated minion ID
Track changes to files under /etc/salt/master.d/ and reactor SLS files to detect attacker-driven reconfiguration

How to Mitigate CVE-2025-22239

Immediate Actions Required

Upgrade Salt Master to version 3006.12 or 3007.4 or later on all masters and syndics
Rotate and re-accept minion keys if a minion is suspected of being compromised
Review reactor SLS files and remove or scope any reactors that execute privileged actions based on untrusted event tags
Restrict network access to the master's publish and return ports (4505/tcp, 4506/tcp) to known minion subnets

Patch Information

The Salt Project addressed CVE-2025-22239 in the 3006.12 and 3007.4 maintenance releases. Details are documented in the Salt Project 3006.12 release notes and the Salt Project 3007.4 release notes. Apply the patched packages on every master and syndic before updating minions.

Workarounds

Disable or tightly scope reactor rules that act on minion-controllable event tags until masters are patched
Segment minions by trust zone and run separate masters for high-value infrastructure so a compromised minion cannot pivot across zones
Enforce least-privilege publisher_acl and client_acl settings on the master to reduce blast radius of injected events

bash

# Verify installed Salt version on the master
salt-master --version

# Upgrade example (Debian/Ubuntu) once repositories are updated
sudo apt-get update && sudo apt-get install --only-upgrade salt-master

# Restrict master ports to known minion subnets
sudo iptables -A INPUT -p tcp -m multiport --dports 4505,4506 \
  -s 10.0.0.0/24 -j ACCEPT
sudo iptables -A INPUT -p tcp -m multiport --dports 4505,4506 -j DROP