8.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-22239

CVE-2025-22239: Salt vulnerable to arbitrary event injection

Arbitrary event injection on Salt Master. The master's "_minion_event" method can be used by and authorized minion to send arbitrary events onto the master's event bus.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-22239

CVE-2025-22239:

8.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
salt	pip	>= 3006.0rc1, < 3006.12	3006.12
salt	pip	>= 3007.0rc1, < 3007.4	3007.4

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability allows an authorized minion to inject arbitrary events onto the Salt Master's event bus. The provided commit 41d834bf800d86fc496e4fac2d3875fc2aca7c62 directly addresses this issue by modifying the _minion_event method within the salt/daemons/masterapi.py file.

The patch introduces a new function valid_minion_tag which is used to check the event["tag"] within _minion_event before the event is fired using self.event.fire_event(event_data, event["tag"]). The addition of this check clearly indicates that _minion_event was the point where the unfiltered, potentially malicious, event tags were processed. Therefore, salt.daemons.masterapi.ClearFuncs._minion_event is identified as the vulnerable function. The vulnerability lies in the lack of input validation for the event tag before this patch.

The root cause is improper authorization/validation of event tags submitted by minions, allowing them to publish events with tags that should be restricted, potentially leading to unintended actions or information disclosure on the master.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.