CVE-2025-62348: Salt Junos Module RCE Vulnerability

CVE-2025-62348 Overview

CVE-2025-62348 affects the Salt configuration management platform. The junos execution module contains an unsafe YAML decode/load usage that fails to restrict deserialized Python object types. A specially crafted YAML payload processed by the module can trigger arbitrary code execution in the context of the Salt process. The Salt Project addressed the issue in the 3006.17 release. The weakness is tracked under CWE-94: Improper Control of Generation of Code.

Critical Impact
An authenticated local attacker who can supply YAML input to the junos module can execute arbitrary Python code with the privileges of the Salt process, compromising confidentiality, integrity, and availability of the host.

Affected Products

Salt (SaltStack) junos execution module
Salt releases prior to 3006.17
Deployments managing Juniper Junos devices through Salt

Discovery Timeline

2026-01-30 - CVE-2025-62348 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-62348

Vulnerability Analysis

The junos execution module in Salt processes YAML data using an unsafe loader. Unsafe YAML loading in Python resolves the !!python/object and related tags into live objects, invoking constructors during parsing. An attacker who can influence the YAML payload passed to the module reaches this deserialization path and executes attacker-controlled Python code.

The flaw is a code injection issue rather than a memory-corruption bug. Exploitation runs entirely within the Python runtime hosting Salt, so the attacker inherits the privileges of the Salt master or minion process handling the request. In common Salt deployments, that process runs as root on Linux hosts managing network infrastructure.

Root Cause

The root cause is the use of an unsafe YAML deserialization primitive, such as yaml.load without the SafeLoader, inside the junos module. PyYAML's default loader instantiates arbitrary Python objects declared in the input stream. Because the module accepts YAML from operational inputs, malicious tags in that stream lead to constructor execution during parsing.

Attack Vector

The attack requires local access with low privileges and some interaction with the affected component to deliver the crafted YAML payload. An attacker with permission to invoke junos module functions, or to influence YAML inputs those functions consume, can trigger deserialization. Successful exploitation yields code execution under the Salt process account. See the Salt Project 3006.17 release notes for remediation context.

No public proof-of-concept has been released. The vulnerability mechanism follows the well-known unsafe YAML deserialization pattern, in which YAML tags referencing Python callables are resolved and executed during load.

Detection Methods for CVE-2025-62348

Indicators of Compromise

YAML payloads containing !!python/object, !!python/object/apply, or !!python/name tags observed in Salt logs, event bus data, or pillar sources.
Unexpected child processes spawned by the Salt master or minion after junos module invocation.
Modifications to Salt state files, pillar data, or Junos device configurations that do not correlate with authorized change records.

Detection Strategies

Inspect Salt job returns and minion logs for junos.* function calls carrying YAML input from untrusted sources.
Alert on process lineage where salt-master or salt-minion spawns shells, interpreters, or network utilities outside baseline behavior.
Correlate access to Salt API endpoints and CLI usage with the identities authorized to run junos module functions.

Monitoring Recommendations

Enable Salt audit logging and forward job events and returners to a centralized SIEM for retention and query.
Baseline the set of users and automation accounts that legitimately invoke the junos module and alert on deviations.
Monitor file integrity on Salt configuration directories, custom modules, and pillar trees for unauthorized YAML content.

How to Mitigate CVE-2025-62348

Immediate Actions Required

Upgrade Salt to release 3006.17 or later on every master, minion, and syndic in the environment.
Restrict access to the junos execution module to trusted operators using Salt's publisher_acl and external auth configuration.
Review recent Salt job history for suspicious junos invocations and unexpected YAML inputs.

Patch Information

The Salt Project fixed the unsafe YAML decode/load usage in the junos execution module in release 3006.17. Apply the update from the Salt Project 3006.17 release notes across all Salt components. Patch the master first, then update minions to keep the control plane consistent.

Workarounds

Disable the junos execution module on hosts that do not manage Juniper Junos devices by adding it to the disable_modules configuration.
Constrain who can run junos.* functions through publisher_acl, client_acl, and external authentication policies until patching is complete.
Treat all YAML inputs consumed by Salt, including pillar and reactor data, as untrusted and validate sources before use.

bash

# Configuration example: restrict access to the junos module in the Salt master config
# /etc/salt/master.d/junos-acl.conf
publisher_acl:
  netops_user:
    - junos.*

disable_modules:
  - junos  # remove this line on hosts that legitimately manage Junos devices