CVE-2025-62349 Salt Master authentication protocol downgrade may enable minion impersonation
A malicious minion can impersonate others by downgrading the authentication protocol, bypassing security features in Salt Master.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-62349?
CVE-2025-62349 is a high-severity authentication bypass vulnerability in Salt, published on 30 Jan 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Salt contains an authentication protocol version downgrade weakness that can allow a malicious minion to bypass newer authentication/security features by using an older request payload format, enabling minion impersonation and circumventing protections introduced in response to prior issues.
Weakness: CWE-287
Which versions are affected by CVE-2025-62349?
5 open source packages ship an affected version, including salt.
| Package | Affected | Fixed in |
|---|---|---|
salt PyPI | From 3006.12 | 3006.17, 3007.9 |
salt PyPI | From 3006.12 | 3006.17 |
salt PyPI | From 3006.12 | 3006.17 |
salt PyPI | From 3007.4 | 3007.9 |
salt PyPI | From 3007.4 | 3007.9 |
How do I fix CVE-2025-62349?
Upgrade salt to a fixed version for your release line: 3006.17 or 3007.9.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2025-62349 being exploited?
There is no known exploitation of CVE-2025-62349 in the wild and no public exploit code.
Sources
Also known as GHSA-vcf3-26xf-fw4m, PYSEC-2026-1902.