CVE-2024-38825 CVE-2024-38825 Salt Advisory
Attackers can bypass PKI authentication in Salt by submitting a public certificate without the private key, gaining unauthorized access.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-38825?
CVE-2024-38825 is a medium-severity authentication bypass vulnerability in VMware SALT, published on 13 Jun 2025. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
The salt.auth.pki module does not properly authenticate callers. The "password" field contains a public certificate which is validated against a CA certificate by the module. This is not pki authentication, as the caller does not need access to the corresponding private key for the authentication attempt to be accepted.
Weakness: CWE-287
Which versions are affected by CVE-2024-38825?
5 open source packages ship an affected version, including salt.
| Package | Affected | Fixed in |
|---|---|---|
salt PyPI | From 3006.0rc1 | 3006.12, 3007.4 |
salt PyPI | From 3006.0rc1 | 3006.12 |
salt PyPI | From 3006.0rc1 | 3006.12 |
salt PyPI | From 3007.0rc1 | 3007.4 |
salt PyPI | From 3007.0rc1 | 3007.4 |
How do I fix CVE-2024-38825?
Upgrade salt to a fixed version for your release line: 3006.12 or 3007.4.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2024-38825 being exploited?
There is no known exploitation of CVE-2024-38825 in the wild and no public exploit code.
Sources
Also known as GHSA-4j59-vv55-q6h3, PYSEC-2026-1893, UBUNTU-CVE-2024-38825.