SaltStack Salt API SSH Client Shell Injection Remote Code Execution Vulnerability (CVE-2020-16846)
Executive & SecOps Summary
SECOPS ASSESSMENTSaltStack Salt versions up to and including 3002 with Salt API and SSH client enabled
Unauthenticated remote attackers can execute arbitrary system commands on the target server by sending crafted HTTP requests
Apply the official SaltStack security patches immediately, or disable the SSH client integration in the Salt API configuration
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
Upgrade your SaltStack installation to the latest patched version using your system's package manager.
# For Debian/Ubuntu-based systems
sudo apt-get update
sudo apt-get --only-upgrade install salt-master salt-common salt-api
# For RedHat/CentOS-based systems
sudo yum clean all
sudo yum update salt-master salt-common salt-api2. Temporary Workaround & Hardening Configuration
If patching cannot be applied immediately, disable the Salt API service or restrict access via firewall rules.
# Stop and disable the Salt API service
sudo systemctl stop salt-api
sudo systemctl disable salt-api
# Restrict access to the Salt API port (default 8000) using iptables
sudo iptables -A INPUT -p tcp --dport 8000 -s 127.0.0.1 -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 8000 -j DROP3. Log Audit & IoC Verification Commands
Inspect the Salt API logs for suspicious requests containing shell metacharacters or unexpected SSH parameters.
# Search Salt API logs for potential shell injection attempts
grep -Ei 'ssh_control|;|\||\&|\`|\$' /var/log/salt/api
# Verify the currently running Salt version
salt --versionBlock Exploits Instantly with Managed Virtual Patching Rules
Can't patch production immediately? Deploy managed WAF rules at the edge to intercept RCE, SQLi, and deserialization payloads before they hit your origin server.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
This vulnerability (CVE-2020-16846) is a critical OS command injection (shell injection) vulnerability residing in the REST API module (salt-api) of SaltStack Salt. The root cause is the lack of proper input validation and sanitization of user-supplied parameters when invoking the SSH client (Salt-SSH) via the Salt API. This allows attackers to inject shell metacharacters into the command execution context.
2. Exploitation Mechanics & Attack Scenario
An attacker can exploit this vulnerability by sending a specially crafted HTTP request (JSON or form-encoded payload) to an exposed Salt API endpoint (such as /run or /login). Because the backend processes these parameters directly within a shell execution context to run SSH commands, the injected shell metacharacters (e.g., ;, &, |) are executed with the privileges of the Salt master process. This bypasses authentication entirely, leading to pre-auth Remote Code Execution (RCE).
3. Infrastructure & Business Impact
With a CVSS score of 9.8 (Critical) and its inclusion in the CISA KEV catalog, this vulnerability poses an extreme risk and is actively exploited in the wild. Successful exploitation grants the attacker complete control over the Salt Master, allowing them to compromise all connected minions, pivot laterally across the internal network, exfiltrate sensitive data, or deploy ransomware and cryptominers.
Official Vendor Advisories & References
An issue was discovered in SaltStack Salt through 3002. Sending crafted web requests to the Salt API, with the SSH client enabled, can result in shell injection.
Frequently Asked SecOps Questions (CVE-2020-16846)
FAQQ1. How critical is CVE-2020-16846 and is it actively exploited in the wild?
CVE-2020-16846 is rated CVSS 9.8 (CRITICAL) with a 30-day EPSS exploitation probability of 99.6%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.
Q2. Which vendors and products are affected by CVE-2020-16846?
Primary impacted vendors include saltstack across salt. Scope summary: SaltStack Salt versions 3002 and prior (with Salt API and SSH client enabled)
Q3. What temporary mitigations or workarounds exist for CVE-2020-16846 before patching?
[Mitigation] Apply the official SaltStack security patches immediately, or disable the SSH client integration in the Salt API configuration Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2020-16846
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (saltstack)
View Category →LiteLLM Proxy Server MCP Test Endpoints Remote Code Execution Vulnerability Advisory (CVE-2026-42271)
[Affected Scope] LiteLLM proxy server environments running versions 1.74.2 to before 1.83.7
Ahsay AhsayCBS Replication Receiver Remote Code Execution (RCE) Vulnerability Advisory (CVE-2026-105134)
[Affected Scope] AhsayCBS versions up to 9.15.2.69 and 10.3.4.44, specifically the Replication Receiver component
Critical RCE in Nextcloud Collabora Online Built-in CODE Server (CVE-2026-110447)
[Affected Scope] Collabora Online Built-in CODE Server (richdocumentscode) for Nextcloud before version 26.4.303.
Zimbra Collaboration Suite (ZCS) Remote Code Execution Vulnerability Advisory (CVE-2026-73570, CISA KEV Listed)
[Affected Scope] Zimbra Collaboration (ZCS) versions prior to 10.1.20, specifically when the optional zimbra-snmp package is installed and SNMP notifications are enabled.
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.