Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability stems from improper validation of the PAM service name during authentication. When PAM external auth is enabled, Salt's authentication mechanism should enforce the use of a pre-configured service name. The PAMAuth.authenticate function would be responsible for handling authentication requests, and if it accepted a client-specified 'service' parameter without checking against the configured value, this would allow service substitution. This matches the CWE-287 (Improper Authentication) pattern where client-controlled input directly influences authentication mechanisms without proper validation. The confidence is high because this is the logical location for PAM authentication handling and the vulnerability description explicitly mentions client-specified service parameters as the attack vector.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| salt | pip | < 2015.5.10 | 2015.5.10 |
| salt | pip | >= 2015.8, < 2015.8.8 | 2015.8.8 |
