CVE-2020-11651: Salt Master authentication bypass

CVE-2020-11651 identifies an authentication bypass in SaltStack Salt's salt-master daemon. The ClearFuncs class fails to properly validate method calls, allowing remote users to access sensitive functions without authentication. Attackers can retrieve user session tokens and execute arbitrary commands on all Salt minions connected to the master.

The vulnerability carries a CVSS score of 9.8 - critical - and affects versions prior to SaltStack Salt 2019.2.4 and 3000.2. A patch has been available since April 30, 2020, but unpatched systems remain exposed. As of November 2026, recent signals show public repositories with declarations of modern proof-of-concept code, indicating renewed technical interest in the vulnerability.

The priority action for administrators is to verify which version of SaltStack Salt is deployed and, if earlier than 2019.2.4 or 3000.2, apply updates without delay. In parallel, audit salt-master logs for anomalous access patterns or token extraction attempts. In environments unable to update immediately, implement network restrictions to the salt-master (segmentation, firewall rules) to limit remote exposure.