7.5

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-62349

CVE-2025-62349: Salt Master authentication protocol downgrade may enable minion impersonation

Salt contains an authentication protocol version downgrade weakness that can allow a malicious minion to bypass newer authentication/security features by using an older request payload format, enabling minion impersonation and circumventing protections introduced in response to prior issues.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-62349

CVE-2025-62349:

7.5

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
salt	pip	>= 3006.12, < 3006.17	3006.17
salt	pip	>= 3007.4, < 3007.9	3007.9

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a protocol downgrade attack within SaltStack's authentication mechanism. A malicious minion could impersonate a legitimate minion by crafting an authentication request that specifies an older, less secure protocol version. The Salt master would previously accept this downgraded version, bypassing security features present in newer protocols.

The analysis of the patch commit 3d5708acae16d039a1e2b5529c8e14a0d3255611 clearly points to the handle_message function within the ReqServerChannel class (located in salt/channel/server.py) as the place where the vulnerability is addressed. This function is the central point for processing incoming requests from minions. The patch adds logic to this function to extract the protocol version from the incoming payload and validate it against a new minimum_auth_version setting in the master's configuration. If the client-provided version is less than the configured minimum, the request is rejected. This directly mitigates the downgrade attack. Therefore, ReqServerChannel.handle_message is the key function that would be observed in a runtime profile during an exploitation attempt of this vulnerability.

Vulnerable functions

ReqServerChannel.handle_message

salt/channel/server.py

This function is responsible for handling incoming messages on the Salt master's request server, including authentication requests from minions. The vulnerability lies in the fact that this function, prior to the patch, would accept a 'version' field from the payload without enforcing a minimum required version. This allowed a malicious minion to force a downgrade to an older, insecure authentication protocol, bypassing security controls like message signing and nonce validation that were introduced in newer versions. The patch introduces a check against the 'minimum_auth_version' configuration option, rejecting any authentication attempts that use a protocol version lower than the configured minimum.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.