{"id":"CVE-2025-22236","aliases":["GHSA-jh7c-xh74-h76f","PYSEC-2026-1899"],"title":"Salt has minion event bus authorization bypass vulnerability","summary":"Salt has minion event bus authorization bypass vulnerability","severity":"high","cvss":8.1,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:L","vendor":"salt","product":"salt","ecosystem":"pip","affected":["salt >= 3007.0, < 3007.4","salt >= 3006.0, < 3006.12"],"patched":["salt 3007.4","salt 3006.12"],"published":"2025-06-13","updated":"2026-07-07","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-jh7c-xh74-h76f","references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-22236"},{"url":"https://docs.saltproject.io/en/3006/topics/releases/3006.12.html"},{"url":"https://docs.saltproject.io/en/3007/topics/releases/3007.4.html"},{"url":"https://github.com/saltstack/salt"}],"tags":["osv","pip"],"epss":0.0017,"epssPercentile":0.06787,"ingestedAt":"2026-07-08T18:25:50.785Z","slug":"CVE-2025-22236","body":"## Overview\n\nMinion event bus authorization bypass. An attacker with access to a minion key can craft a message which may be able to execute a job on other minions (>= 3007.0).\n\n## Affected packages\n\n- `salt >= 3007.0, < 3007.4`\n- `salt >= 3006.0, < 3006.12`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `salt 3007.4`\n- `salt 3006.12`","depth":"twilight","depthScore":45,"depthScoreParts":{"impact":44.6,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}