{"action":"Upgrade salt to 2015.8.10 or later.","affected":[{"fixed":"2015.8.10","introduced":"0"},{"fixed":"2015.8.13","introduced":"2015.8.11"},{"fixed":"2016.3.4","introduced":"2016.3.0"},{"fixed":"2016.3.6","introduced":"2016.3.5"},{"fixed":"2016.3.8","introduced":"2016.3.7"},{"fixed":"2016.11.3","introduced":"2016.11.0"},{"fixed":"2016.11.5","introduced":"2016.11.4"},{"fixed":"2016.11.10","introduced":"2016.11.7"},{"fixed":"2017.7.8","introduced":"2017.7.0"},{"fixed":"2019.2.0rc1","introduced":"2018.3.0rc1"},{"fixed":"2019.2.5","introduced":"2019.2.0"},{"fixed":"2019.2.8","introduced":"2019.2.6"},{"fixed":"3000.6","introduced":"3000"},{"fixed":"3001.4","introduced":"3001"},{"fixed":"3002.5","introduced":"3002"}],"component":"salt","cve_ids":["CVE-2021-25281"],"ecosystem":"PyPI","epss":0.7313,"exploited":false,"fixed_versions":["2015.8.10","2015.8.13","2016.3.4","2016.3.6","2016.3.8","2016.11.3","2016.11.5","2016.11.10","2017.7.8","2019.2.0rc1","2019.2.5","2019.2.8","3000.6","3001.4","3002.5"],"ghsa_id":"GHSA-xxw3-765m-f37p","id":"tcs_01M5KGDF9FCRJEG7DVG2Z8JTX6","modified_at":"2026-06-10T17:02:38.591335176Z","published_at":"2021-02-27T05:15:00Z","references":["https://osv.dev/vulnerability/PYSEC-2021-50","https://github.com/saltstack/salt/releases","https://www.saltstack.com/blog/active-saltstack-cve-announced-2021-jan-21/","https://saltproject.io/security_announcements/active-saltstack-cve-release-2021-feb-25/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YOGNT2XWPOYV7YT75DN7PS4GIYWFKOK5/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7GRVZ5WAEI3XFN2BDTL6DDXFS5HYSDVB/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FUGLOJ6NXLCIFRD2JTXBYQEMAEF2B6XH/","https://security.gentoo.org/glsa/202103-01","http://packetstormsecurity.com/files/162058/SaltStack-Salt-API-Unauthenticated-Remote-Command-Execution.html","https://github.com/advisories/GHSA-xxw3-765m-f37p"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"PYSEC-2021-50","url":"https://osv.dev/vulnerability/PYSEC-2021-50"}],"summary":"An issue was discovered in through SaltStack Salt before 3002.5. salt-api does not honor eauth credentials for the wheel_async client. Thus, an attacker can remotely run any wheel modules on the maste"}