CVE-2017-7893
SaltStack Salt allows compromised salt-minions to impersonate the salt-master
CVE-2017-7893 is a critical vulnerability (CVSS 9.8) in Saltstack Salt, published April 23, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.39%, the 72nd percentile. Fixed in salt 2016.3.6.
In SaltStack Salt before 2016.3.6, compromised salt-minions can impersonate the salt-master.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
In SaltStack Salt before 2016.3.6, compromised salt-minions can impersonate the salt-master.
- Record
CVE-2017-7893- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Updated
- 2026-11-02
CVE List No score
In SaltStack Salt before 2016.3.6, compromised salt-minions can impersonate the salt-master.
- Record
CVE-2017-7893- Updated
- 2026-11-02
EUVDEUVD-2018-0135 No score
In SaltStack Salt before 2016.3.6, compromised salt-minions can impersonate the salt-master.
- Record
EUVD-2018-0135- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-g283-88v5-rmq2
SaltStack Salt allows compromised salt-minions to impersonate the salt-master
In SaltStack Salt before 2016.3.6, compromised salt-minions can impersonate the salt-master.
- Record
GHSA-g283-88v5-rmq2- CVSS 4.0
- 9.3 Critical
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N - CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSV
In SaltStack Salt before 2016.3.6, compromised salt-minions can impersonate the salt-master.
- Record
CVE-2017-7893- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVGHSA-g283-88v5-rmq2
SaltStack Salt allows compromised salt-minions to impersonate the salt-master
In SaltStack Salt before 2016.3.6, compromised salt-minions can impersonate the salt-master.
- Record
GHSA-g283-88v5-rmq2- CVSS 4.0
- 9.3 Critical
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N - CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2017-7893
In SaltStack Salt before 2016.3.6, compromised salt-minions can impersonate the salt-master.
- Record
UBUNTU-CVE-2017-7893- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVPYSEC-2018-50 No score
In SaltStack Salt before 2016.3.6, compromised salt-minions can impersonate the salt-master.
- Record
PYSEC-2018-50- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
saltPyPI |
before 2016.3.6 | 2016.3.6 |
saltPyPI |
before 2016.3.6, plus listed versions 0.10.00.10.10.10.20.10.30.10.4 Show 45 moreShow less0.10.50.11.00.11.10.12.00.12.10.13.00.13.10.13.20.13.30.14.00.14.10.15.00.15.10.15.20.15.30.15.900.16.00.16.10.16.20.16.30.16.40.17.00.17.0rc10.17.10.17.20.17.30.17.40.17.50.8.70.8.90.9.00.9.10.9.20.9.30.9.40.9.50.9.60.9.70.9.80.9.90.9.9.12014.1.02014.1.0rc12014.1.0rc22014.1.0rc3 |
2016.3.6 |
saltUbuntu:Pro:14.04:LTS |
All versions, plus listed versions 0.16.0-10.16.4-20.17.1+dfsg-10.17.2-10.17.2-2 Show 9 moreShow less0.17.2-30.17.4-10.17.4-20.17.5-10.17.5+ds-10.17.5+ds-1ubuntu0.1~esm10.17.5+ds-1ubuntu0.1~esm20.17.5+ds-1ubuntu0.1~esm40.17.5+ds-1ubuntu0.1~esm5 |
None known |
saltUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 2015.5.3+ds-12015.8.1+ds-22015.8.3+ds-12015.8.3+ds-22015.8.3+ds-3 Show 7 moreShow less2015.8.5+ds-12015.8.7+ds-12015.8.8+ds-12015.8.8+ds-1ubuntu0.1~esm12015.8.8+ds-1ubuntu0.12015.8.8+ds-1ubuntu0.1+esm12015.8.8+ds-1ubuntu0.1+esm2 |
None known |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
Left out here: 69 versions. The JSON record has them.