CVE-2015-6941

salt password information leaked in debug logs

9.8 CriticalFix available

win_useradd, salt-cloud and the Linode driver in salt 2015.5.x before 2015.5.6, and 2015.8.x before 2015.8.1 leak password information in debug logs.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

2.83%Up 1.8 points since Feb 4, 2022

What each source reports

NVD Score used 9.8

win_useradd, salt-cloud and the Linode driver in salt 2015.5.x before 2015.5.6, and 2015.8.x before 2015.8.1 leak password information in debug logs.

Record: CVE-2015-6941
CVSS 3.0: 9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0: 5.0 MediumAV:N/AC:L/Au:N/C:P/I:N/A:N
Weakness: CWE-534
Updated: 2026-11-02

CVE List No score

win_useradd, salt-cloud and the Linode driver in salt 2015.5.x before 2015.5.6, and 2015.8.x before 2015.8.1 leak password information in debug logs.

Record: CVE-2015-6941
Updated: 2026-11-02

EUVDEUVD-2017-0125 No score

win_useradd, salt-cloud and the Linode driver in salt 2015.5.x before 2015.5.6, and 2015.8.x before 2015.8.1 leak password information in debug logs.

Record: EUVD-2017-0125
Updated: 2026-11-03

GitHub AdvisoriesGHSA-cxm4-7qcw-267r 9.8

salt password information leaked in debug logs

win_useradd, salt-cloud and the Linode driver in salt 2015.5.x before 2015.5.6, and 2015.8.x before 2015.8.1 leak password information in debug logs.

Record: GHSA-cxm4-7qcw-267r
CVSS 3.0: 9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-200
Updated: 2026-11-02

OSVGHSA-cxm4-7qcw-267r 9.8

salt password information leaked in debug logs

win_useradd, salt-cloud and the Linode driver in salt 2015.5.x before 2015.5.6, and 2015.8.x before 2015.8.1 leak password information in debug logs.

Record: GHSA-cxm4-7qcw-267r
CVSS 3.0: 9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-200
Updated: 2026-11-02

OSVUBUNTU-CVE-2015-6941 9.8

win_useradd, salt-cloud and the Linode driver in salt 2015.5.x before 2015.5.6, and 2015.8.x before 2015.8.1 leak password information in debug logs.

Record: UBUNTU-CVE-2015-6941
CVSS 3.0: 9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVPYSEC-2017-71 No score

win_useradd, salt-cloud and the Linode driver in salt 2015.5.x before 2015.5.6, and 2015.8.x before 2015.8.1 leak password information in debug logs.

Record: PYSEC-2017-71
Updated: 2026-11-02

OSVUSN-4769-1 No score

salt vulnerabilities

It was discovered that Salt allowed remote attackers to write to arbitrary files via a special crafted file. An attacker could use this vulnerability to cause a DoS or possibly execute arbitrary code. This issue only affected Ubuntu 14.04 ESM. (CVE-2014-3563)

Andreas Stieger discovered that Salt exposed git usernames and passwords in log files. An attacker could use this issue to retrieve sensitive information. This issue only affected Ubuntu 14.04 ESM. (CVE-2015-6918).

It was discovered that Salt exposed password authentication credentials in log files. An attacker could use this issue to retrieve sensitive information. This issue only affected Ubuntu 14.04 ESM. (CVE-2015-6941)

It was discovered that Salt allowed remote attackers to write to arbitrary files via a special crafted file. An attacker could use this issue to cause a DoS or possibly execute arbitrary code. (CVE-2017-12791, CVE-2017-14695, CVE-2017-14696)

It was discovered that Salt allowed remote attackers to determine which files exist on the server. An attacker could use this issue to extract sensitive information. This issue only affected Ubuntu 16.04 ESM. (CVE-2018-15750)

It was discovered that Salt allowed users to bypass authentication. An attacker could use this issue to extract sensitive information, execute arbitrary code or crash the server. This issue only affected Ubuntu 16.04 ESM. (CVE-2018-15751)

Record: USN-4769-1
Updated: 2026-11-02

Affected products

saltstack salt 2015

Affected packages

Affected packages
Package	Affected	Fixed
`salt` PyPI	2015.5 up to 2015.5.6	2015.5.6
`salt` PyPI	2015.8 up to 2015.8.1	2015.8.1
`salt` PyPI	2015.5 up to 2015.5.6, plus listed versions 2015.5.02015.5.12015.5.22015.5.32015.5.42015.5.5	2015.5.6
`salt` PyPI	2015.8 up to 2015.8.1, plus listed versions 2015.8.0	2015.8.1
`salt` PyPI	2015.5 up to 2015.5.6, 2015.8 up to 2015.8.1, plus listed versions 2015.5.02015.5.12015.5.22015.5.32015.5.4 Show 41 moreShow less 2015.5.52015.8.0v2014.7.6v2014.7.5v2014.7.4v2014.7.3v2014.7.2v2014.7.1v2014.7.0v2014.7v2014.7.0rc7v2014.7.0rc6v2014.7.0rc5v2014.7.0rc3v2014.7.0rc4v2014.7.0rc2v2014.7.0rc1v2014.1v0.17v0.16v0.15.0v0.14.0v0.13.0v0.12.0v0.11.0v0.10.5v0.10.4v0.10.3v0.10.2v0.10.1v0.10.0v0.9.9v0.9.3v0.9.2v0.9.1v0.9.0v0.8.9v0.8.7v0.8.0v0.7.0v0.6.0	2015.5.62015.8.1
`salt` Ubuntu:Pro:14.04:LTS	before 0.17.5+ds-1ubuntu0.1~esm1, plus listed versions 0.16.0-10.16.4-20.17.1+dfsg-10.17.2-10.17.2-2 Show 5 moreShow less 0.17.2-30.17.4-10.17.4-20.17.5-10.17.5+ds-1	0.17.5+ds-1ubuntu0.1~esm1
`salt` Ubuntu:Pro:16.04:LTS	before 2015.8.8+ds-1ubuntu0.1+esm1, plus listed versions 2015.5.3+ds-12015.8.1+ds-22015.8.3+ds-12015.8.3+ds-22015.8.3+ds-3 Show 5 moreShow less 2015.8.5+ds-12015.8.7+ds-12015.8.8+ds-12015.8.8+ds-1ubuntu0.1~esm12015.8.8+ds-1ubuntu0.1	2015.8.8+ds-1ubuntu0.1+esm1

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2015-6941 is a critical vulnerability (CVSS 9.8) in Saltstack Salt 2015, published August 9, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.83%, the 86th percentile. Fixed in salt 2015.5.6.

References

Show 14 moreShow less