CVE-2016-3176
Salt Insecure configuration of PAM external authentication service
Salt before 2015.5.10 and 2015.8.x before 2015.8.8, when PAM external authentication is enabled, allows attackers to bypass the configured authentication service by passing an alternate service with a command sent to LocalClient.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- Low
Exploit likelihood
What each source reports
NVD Score used
Salt before 2015.5.10 and 2015.8.x before 2015.8.8, when PAM external authentication is enabled, allows attackers to bypass the configured authentication service by passing an alternate service with a command sent to LocalClient.
- Record
CVE-2016-3176- CVSS 3.0
- 5.6 Medium
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:P/I:N/A:N - Weakness
- CWE-287
- Updated
- 2026-11-02
CVE List No score
Salt before 2015.5.10 and 2015.8.x before 2015.8.8, when PAM external authentication is enabled, allows attackers to bypass the configured authentication service by passing an alternate service with a command sent to LocalClient.
- Record
CVE-2016-3176- Updated
- 2026-11-02
EUVDEUVD-2017-0117 No score
Salt before 2015.5.10 and 2015.8.x before 2015.8.8, when PAM external authentication is enabled, allows attackers to bypass the configured authentication service by passing an alternate service with a command sent to LocalClient.
- Record
EUVD-2017-0117- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-v2rp-9cpj-pfw2
Salt Insecure configuration of PAM external authentication service
Salt before 2015.5.10 and 2015.8.x before 2015.8.8, when PAM external authentication is enabled, allows attackers to bypass the configured authentication service by passing an alternate service with a command sent to LocalClient.
- Record
GHSA-v2rp-9cpj-pfw2- CVSS 3.0
- 5.6 Medium
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L - Weakness
- CWE-287
- Updated
- 2026-11-02
OSV
Salt before 2015.5.10 and 2015.8.x before 2015.8.8, when PAM external authentication is enabled, allows attackers to bypass the configured authentication service by passing an alternate service with a command sent to LocalClient.
- Record
CVE-2016-3176- CVSS 3.0
- 5.6 Medium
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L - Updated
- 2026-11-02
OSVGHSA-v2rp-9cpj-pfw2
Salt Insecure configuration of PAM external authentication service
Salt before 2015.5.10 and 2015.8.x before 2015.8.8, when PAM external authentication is enabled, allows attackers to bypass the configured authentication service by passing an alternate service with a command sent to LocalClient.
- Record
GHSA-v2rp-9cpj-pfw2- CVSS 3.0
- 5.6 Medium
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L - Weakness
- CWE-287
- Updated
- 2026-11-02
Show 6 moreShow less
OSVUBUNTU-CVE-2016-3176
Salt before 2015.5.10 and 2015.8.x before 2015.8.8, when PAM external authentication is enabled, allows attackers to bypass the configured authentication service by passing an alternate service with a command sent to LocalClient.
- Record
UBUNTU-CVE-2016-3176- CVSS 3.0
- 5.6 Medium
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L - Updated
- 2026-11-02
OSVPYSEC-2017-33 No score
Salt before 2015.5.10 and 2015.8.x before 2015.8.8, when PAM external authentication is enabled, allows attackers to bypass the configured authentication service by passing an alternate service with a command sent to LocalClient.
- Record
PYSEC-2017-33- Updated
- 2026-11-02
OSVSUSE-SU-2016:0970-1 No score
Security update for salt
salt was updated to fix one security issue.
This security issue was fixed:
- CVE-2016-3176: Insecure configuration of PAM external authentication service. Authenticating were able to specify the PAM service (bsc#972436).
- Record
SUSE-SU-2016:0970-1- Updated
- 2026-11-02
OSVSUSE-SU-2016:0972-1 No score
Security update for salt
salt was updated to fix one security issue.
This security issue was fixed:
- CVE-2016-3176: Insecure configuration of PAM external authentication service. Authenticating were able to specify the PAM service (bsc#972436).
- Record
SUSE-SU-2016:0972-1- Updated
- 2026-11-02
OSVSUSE-SU-2016:1343-1 No score
Security update for salt
salt was updated to fix one security issue.
This security issue was fixed:
- CVE-2016-3176: Insecure configuration of PAM external authentication service. Authenticating were able to specify the PAM service (bsc#972436).
- Record
SUSE-SU-2016:1343-1- Updated
- 2026-11-02
OSVUSN-8153-1 No score
salt vulnerabilities
Zach Malone discovered that Salt did not properly handle permissions to cache data. A local attacker could possibly use this issue to obtain sensitive information. (CVE-2015-8034) Dylan Frese discovered that Salt incorrectly allowed users to specify PAM service. An attacker could possibly use this issue to bypass authentication. (CVE-2016-3176)
- Record
USN-8153-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
saltPyPI |
before 2015.5.10 | 2015.5.10 |
saltPyPI |
2015.8 up to 2015.8.8 | 2015.8.8 |
saltPyPI |
before 2015.5.10, plus listed versions 0.10.00.10.10.10.20.10.30.10.4 Show 45 moreShow less0.10.50.11.00.11.10.12.00.12.10.13.00.13.10.13.20.13.30.14.00.14.10.15.00.15.10.15.20.15.30.15.900.16.00.16.10.16.20.16.30.16.40.17.00.17.0rc10.17.10.17.20.17.30.17.40.17.50.8.70.8.90.9.00.9.10.9.20.9.30.9.40.9.50.9.60.9.70.9.80.9.90.9.9.12014.1.02014.1.0rc12014.1.0rc22014.1.0rc3 |
2015.5.10 |
saltPyPI |
2015.8 up to 2015.8.8, plus listed versions 2015.8.02015.8.12015.8.22015.8.32015.8.42015.8.52015.8.7 |
2015.8.8 |
saltPyPI |
before 2015.5.10, 2015.8 up to 2015.8.8, plus listed versions 0.10.00.10.10.10.20.10.30.10.4 Show 45 moreShow less0.10.50.11.00.11.10.12.00.12.10.13.00.13.10.13.20.13.30.14.00.14.10.15.00.15.10.15.20.15.30.15.900.16.00.16.10.16.20.16.30.16.40.17.00.17.0rc10.17.10.17.20.17.30.17.40.17.50.8.70.8.90.9.00.9.10.9.20.9.30.9.40.9.50.9.60.9.70.9.80.9.90.9.9.12014.1.02014.1.0rc12014.1.0rc22014.1.0rc3 |
2015.5.102015.8.8 |
saltSUSE:Enterprise Storage 2 |
before 2014.1.10-3.1 | 2014.1.10-3.1 |
saltSUSE:Enterprise Storage 2.1 |
before 2014.1.10-5.1 | 2014.1.10-5.1 |
saltSUSE:Enterprise Storage 1.0 |
before 2014.1.10-5.6 | 2014.1.10-5.6 |
saltUbuntu:Pro:14.04:LTS |
before 0.17.5+ds-1ubuntu0.1~esm5, plus listed versions 0.16.0-10.16.4-20.17.1+dfsg-10.17.2-10.17.2-2 Show 8 moreShow less0.17.2-30.17.4-10.17.4-20.17.5-10.17.5+ds-10.17.5+ds-1ubuntu0.1~esm10.17.5+ds-1ubuntu0.1~esm20.17.5+ds-1ubuntu0.1~esm4 |
0.17.5+ds-1ubuntu0.1~esm5 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2016-3176 is a medium vulnerability (CVSS 5.6) in Saltstack Salt, published April 7, 2016. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.87%, the 58th percentile. Fixed in salt 2015.5.10.
References
docs.saltstack.com/en/latest/topics/releases/2015.8.8.html
nvd.nist.gov/vuln/detail/CVE-2016-3176
github.com/pypa/advisory-database/tree/main/vulns/salt/PYSEC-2017-33.yaml
Show 9 moreShow less
suse.com/support/update/announcement/2016/suse-su-20160970-1
bugzilla.suse.com/972436
ubuntu.com/security/CVE-2016-3176
cve.org/CVERecord?id=CVE-2016-3176
Left out here: 87 versions. The JSON record has them.