Critical 9.8Known exploited (CISA KEV)Published Nov 6, 2020

CVE-2020-16846An issue was discovered in SaltStack Salt through 3002.

Updated under an hour ago (Oct 26, 2026, 11:40 PM ET)

Does this affect you?

It affects saltstack salt and 3 other products. Add what you run to find out whether that includes you.

CISA lists it as known exploited since Nov 3, 2021; federal agencies had to remediate by May 3, 2022. Treat that date as your deadline.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for saltstack salt

Exploited in the last 30 days

An issue was discovered in SaltStack Salt through 3002. Sending crafted web requests to the Salt API, with the SSH client enabled, can result in shell injection.

CVSS: 9.8 CRITICAL (v3.1, CISA ADP)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): CWE-78
Known exploited: Added to CISA KEV Nov 3, 2021; federal remediation due May 3, 2022Apply updates per vendor instructions.
EPSS (exploitation in the next 30 days): 99.59% (percentile 100)
Assigned by: mitre
NVD analysis: Analyzed
Record last updated: Oct 21, 2025
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

saltstack salt saltstack:salt	before 2015.8.10; from 2015.8.11 before 2015.8.13; from 2016.3.0 before 2016.3.4; from 2016.3.5 before 2016.3.6; from 2016.3.7 before 2016.3.8; from 2016.11.0 before 2016.11.3; from 2016.11.4 before 2016.11.6; from 2016.11.7 before 2016.11.10; and 7 more ranges	NVD
debian debian_linux debian:debian_linux	9.0; 10.0	NVD
fedoraproject fedora fedoraproject:fedora	31	NVD
opensuse leap opensuse:leap	15.1	NVD

References

References

https://github.com/saltstack/salt/releases	x-refsource-misc, release-notes
https://www.saltstack.com/blog/on-november-3-2020-saltstack-publicly-disclosed-three-new-cves/	x-refsource-confirm, broken-link, vendor-advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TPOGB2F6XUAIGFDTOCQDNB2VIXFXHWMA/	vendor-advisory, x-refsource-fedora, release-notes
http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00029.html	vendor-advisory, x-refsource-suse, mailing-list, third-party-advisory
https://security.gentoo.org/glsa/202011-13	vendor-advisory, x-refsource-gentoo, third-party-advisory
http://packetstormsecurity.com/files/160039/SaltStack-Salt-REST-API-Arbitrary-Command-Execution.html	x-refsource-misc, exploit, third-party-advisory, vdb-entry
https://www.zerodayinitiative.com/advisories/ZDI-20-1381/	x-refsource-misc, third-party-advisory, vdb-entry
https://www.zerodayinitiative.com/advisories/ZDI-20-1383/	x-refsource-misc, third-party-advisory, vdb-entry
https://www.zerodayinitiative.com/advisories/ZDI-20-1380/	x-refsource-misc, third-party-advisory, vdb-entry
https://www.zerodayinitiative.com/advisories/ZDI-20-1379/	x-refsource-misc, third-party-advisory, vdb-entry
1–10 of 15

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.