The vulnerability stems from the local_batch client interface in salt-api not respecting external authentication. The core execution path for batch commands (handled by LocalBatchClient.cmd_batch) and the API endpoint handler (NetapiClient.run in rest_cherrypy) are the logical points where authentication checks would normally occur. The CVE description explicitly implicates the local_batch client flow, and SaltStack's architecture places these authentication checks at the API entrypoint and client execution layer. The lack of eauth validation in these functions directly enables the bypass.