CVE-2024-38822 CVE-2024-38822 Salt Advisory
A misbehaving minion can impersonate another minion due to skipped token validation, allowing unauthorized access and potential privilege escalation.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-38822?
CVE-2024-38822 is a low-severity authentication bypass vulnerability in VMware SALT, published on 13 Jun 2025. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Multiple methods in the salt master skip minion token validation. Therefore a misbehaving minion can impersonate another minion.
Weakness: CWE-287
Which versions are affected by CVE-2024-38822?
How do I fix CVE-2024-38822?
Apply the vendor's patch.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2024-38822 being exploited?
There is no known exploitation of CVE-2024-38822 in the wild and no public exploit code.
Sources
Also known as GHSA-5m5v-pwj7-rj26, UBUNTU-CVE-2024-38822.