CVE-2021-25315: salt-api unauthenticated remote code execution

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-03-03 · updated 2026-06-17
Weakness: CWE-287

Description

CWE - CWE-287: Improper Authentication vulnerability in SUSE Linux Enterprise Server 15 SP 3; openSUSE Tumbleweed allows local attackers to execute arbitrary code via salt without the need to specify valid credentials. This issue affects: SUSE Linux Enterprise Server 15 SP 3 salt versions prior to 3002.2-3. openSUSE Tumbleweed salt version 3002.2-2.1 and prior versions. This issue affects: SUSE Linux Enterprise Server 15 SP 3 salt versions prior to 3002.2-3. openSUSE Tumbleweed salt version 3002.2-2.1 and prior versions.

Affected products

VMware SALT: before 3002.2 — fixed in 3002.2

How to fix

Upgrade to a fixed version: VMware SALT 3002.2. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2021-25315 or the next vulnerability affects your stack