Every CVE Search/ Get API key

CVE-2017-5192

SaltStack Salt Authentication Bypass when using the local_batch client from salt-api

8.8 HighFix available

When using the local_batch client from salt-api in SaltStack Salt before 2015.8.13, 2016.3.x before 2016.3.5, and 2016.11.x before 2016.11.2, external authentication is not respected, enabling all authentication to be bypassed.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

1.70%Up 0.9 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 8.8

When using the local_batch client from salt-api in SaltStack Salt before 2015.8.13, 2016.3.x before 2016.3.5, and 2016.11.x before 2016.11.2, external authentication is not respected, enabling all authentication to be bypassed.

Record
CVE-2017-5192
CVSS 3.0
8.8 HighCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0
6.5 MediumAV:N/AC:L/Au:S/C:P/I:P/A:P
Weakness
CWE-287
Updated
2026-11-02
CVE List No score

When using the local_batch client from salt-api in SaltStack Salt before 2015.8.13, 2016.3.x before 2016.3.5, and 2016.11.x before 2016.11.2, external authentication is not respected, enabling all authentication to be bypassed.

Record
CVE-2017-5192
Updated
2026-11-02
EUVDEUVD-2017-0122 No score

When using the local_batch client from salt-api in SaltStack Salt before 2015.8.13, 2016.3.x before 2016.3.5, and 2016.11.x before 2016.11.2, external authentication is not respected, enabling all authentication to be bypassed.

Record
EUVD-2017-0122
Updated
2026-11-03
GitHub AdvisoriesGHSA-f2h7-4f84-8qrm 8.8

SaltStack Salt Authentication Bypass when using the local_batch client from salt-api

When using the local_batch client from salt-api in SaltStack Salt before 2015.8.13, 2016.3.x before 2016.3.5, and 2016.11.x before 2016.11.2, external authentication is not respected, enabling all authentication to be bypassed.

Record
GHSA-f2h7-4f84-8qrm
CVSS 3.0
8.8 HighCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-287
Updated
2026-11-02
OSV 8.8

When using the local_batch client from salt-api in SaltStack Salt before 2015.8.13, 2016.3.x before 2016.3.5, and 2016.11.x before 2016.11.2, external authentication is not respected, enabling all authentication to be bypassed.

Record
CVE-2017-5192
CVSS 3.0
8.8 HighCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVGHSA-f2h7-4f84-8qrm 8.8

SaltStack Salt Authentication Bypass when using the local_batch client from salt-api

When using the local_batch client from salt-api in SaltStack Salt before 2015.8.13, 2016.3.x before 2016.3.5, and 2016.11.x before 2016.11.2, external authentication is not respected, enabling all authentication to be bypassed.

Record
GHSA-f2h7-4f84-8qrm
CVSS 3.0
8.8 HighCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-287
Updated
2026-11-02
OSVUBUNTU-CVE-2017-5192 8.8

When using the local_batch client from salt-api in SaltStack Salt before 2015.8.13, 2016.3.x before 2016.3.5, and 2016.11.x before 2016.11.2, external authentication is not respected, enabling all authentication to be bypassed. The LocalClient.cmd_batch() method client does not accept external_auth credentials and so access to it from salt-api has been removed for now. This vulnerability allows code execution for already-authenticated users and is only in effect when running salt-api as the root user.

Record
UBUNTU-CVE-2017-5192
CVSS 3.0
8.8 HighCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVPYSEC-2017-38 No score

When using the local_batch client from salt-api in SaltStack Salt before 2015.8.13, 2016.3.x before 2016.3.5, and 2016.11.x before 2016.11.2, external authentication is not respected, enabling all authentication to be bypassed.

Record
PYSEC-2017-38
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
salt
PyPI
 before 2015.8.13
2015.8.13
salt
PyPI
 2016.3.0 up to 2016.3.5
2016.3.5
salt
PyPI
 2016.11.0 up to 2016.11.2
2016.11.2
salt
PyPI
 before 2015.8.13, plus listed versions
0.10.00.10.10.10.20.10.30.10.4
Show 45 moreShow less
0.10.50.11.00.11.10.12.00.12.10.13.00.13.10.13.20.13.30.14.00.14.10.15.00.15.10.15.20.15.30.15.900.16.00.16.10.16.20.16.30.16.40.17.00.17.0rc10.17.10.17.20.17.30.17.40.17.50.8.70.8.90.9.00.9.10.9.20.9.30.9.40.9.50.9.60.9.70.9.80.9.90.9.9.12014.1.02014.1.0rc12014.1.0rc22014.1.0rc3
2015.8.13
salt
PyPI
 2016.3.0 up to 2016.3.5, plus listed versions
2016.3.12016.3.22016.3.32016.3.4
2016.3.5
salt
PyPI
 2016.11.0 up to 2016.11.2, plus listed versions
2016.11.1
2016.11.2
salt
PyPI
 before 2015.8.13, 2016.3 up to 2016.3.5, 2016.11 up to 2016.11.2, plus listed versions
0.10.00.10.10.10.20.10.30.10.4
Show 45 moreShow less
0.10.50.11.00.11.10.12.00.12.10.13.00.13.10.13.20.13.30.14.00.14.10.15.00.15.10.15.20.15.30.15.900.16.00.16.10.16.20.16.30.16.40.17.00.17.0rc10.17.10.17.20.17.30.17.40.17.50.8.70.8.90.9.00.9.10.9.20.9.30.9.40.9.50.9.60.9.70.9.80.9.90.9.9.12014.1.02014.1.0rc12014.1.0rc22014.1.0rc3
2015.8.132016.3.52016.11.2
salt
Ubuntu:Pro:14.04:LTS
 All versions, plus listed versions
0.16.0-10.16.4-20.17.1+dfsg-10.17.2-10.17.2-2
Show 9 moreShow less
0.17.2-30.17.4-10.17.4-20.17.5-10.17.5+ds-10.17.5+ds-1ubuntu0.1~esm10.17.5+ds-1ubuntu0.1~esm20.17.5+ds-1ubuntu0.1~esm40.17.5+ds-1ubuntu0.1~esm5
 None known
salt
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
2015.5.3+ds-12015.8.1+ds-22015.8.3+ds-12015.8.3+ds-22015.8.3+ds-3
Show 7 moreShow less
2015.8.5+ds-12015.8.7+ds-12015.8.8+ds-12015.8.8+ds-1ubuntu0.1~esm12015.8.8+ds-1ubuntu0.12015.8.8+ds-1ubuntu0.1+esm12015.8.8+ds-1ubuntu0.1+esm2
 None known

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2017-5192 is a high vulnerability (CVSS 8.8) in Saltstack Salt, published September 26, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.70%, the 77th percentile. Fixed in salt 2015.8.13.

References

This page doesn't list everything

Left out here: 127 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open