8.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-22236

CVE-2025-22236: Salt has minion event bus authorization bypass vulnerability

Minion event bus authorization bypass. An attacker with access to a minion key can craft a message which may be able to execute a job on other minions (>= 3007.0).

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-22236

CVE-2025-22236:

8.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
salt	pip	>= 3007.0, < 3007.4	3007.4
salt	pip	>= 3006.0, < 3006.12	3006.12

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability CVE-2025-22236 describes a minion event bus authorization bypass in Salt. An attacker with access to a minion key can craft a message to execute jobs on other minions. The provided commit 41d834bf800d86fc496e4fac2d3875fc2aca7c62 directly addresses this by implementing event tag filtering.

The core of the vulnerability lies in the _minion_event function within salt/daemons/masterapi.py. This function is responsible for handling events sent from minions to the master. Prior to the patch, this function would process events without sufficiently validating the event tags. Certain event tags are intended for internal use by the master or for specific privileged operations. By allowing a minion to send events with these tags, an attacker could bypass authorization checks and trigger actions on other minions or the master itself.

The patch introduces a blacklist of event tags (MINION_EVENT_BLACKLIST) and a new function valid_minion_tag to check if an incoming event's tag is on this blacklist. The _minion_event function is modified to call valid_minion_tag and discard events with blacklisted tags. This change prevents minions from injecting events that could lead to unauthorized command execution. Therefore, salt.daemons.masterapi._minion_event is identified as the vulnerable function because it was the entry point for processing these potentially malicious, unvalidated events.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.