PT-2026-5435 · Salt+1 · Salt+1

Barney Sowood · CVE-2025-62349 · Published 2025-11-28 · Updated 2026-07-07

Positive Technologies (AI Summary)

CVSS v2.0

8.0

High

Base vector

AV:N/AC:L/Au:M/C:C/I:C/A:P

Name of the Vulnerable Software and Affected Versions Salt (affected versions not specified)

Description Salt is susceptible to an authentication protocol version downgrade. A malicious minion can exploit this to bypass newer authentication and security features by utilizing an older request payload format. This allows for minion impersonation and circumvents security measures implemented to address previous issues.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

BDU:2026-05706

CVE-2025-62349

GHSA-VCF3-26XF-FW4M

OPENSUSE-SU-2025:15787-1

OPENSUSE-SU-2026:20000-1

PYSEC-2026-1902

SUSE-EL-9-CLIENT-TOOLS-2025-4474

SUSE-EL-9-CLIENT-TOOLS-2026-1026

SUSE-SU-2025:21216-1

SUSE-SU-2025:21218-1

SUSE-SU-2025:4445-1

SUSE-SU-2025:4447-1

SUSE-SU-2025:4448-1

SUSE-SU-2025:4449-1

SUSE-SU-2025:4450-1

SUSE-SU-2025:4466-1

SUSE-SU-2025:4467-1

SUSE-SU-2025:4474-1

SUSE-SU-2025:4475-1

SUSE-SU-2025:4476-1

SUSE-SU-2025:4477-1

SUSE-SU-2025:4478-1

SUSE-SU-2025:4479-1

SUSE-SU-2026:1012-1

SUSE-SU-2026:1014-1

SUSE-SU-2026:1026-1

SUSE-SU-2026:1140-1

SUSE-SU-2026:1141-1

SUSE-SU-2026:1142-1

SUSE-SU-2026:1146-1

SUSE-SU-2026:1148-1

SUSE-SU-2026:1149-1

Affected Products

Red Os

Salt

References · 138

• https://osv.dev/vulnerability/SUSE-SU-2026:1148-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-EL-9-CLIENT-TOOLS-2025-4474 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:15787-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-EL-9-CLIENT-TOOLS-2026-1026 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2025:4478-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-05706 · Security Note
• https://docs.saltproject.io/en/latest/topics/releases/3007.9.html · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:1014-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-62349 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2025:4467-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2025:4474-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:20000-1 · Vendor Advisory
• https://docs.saltproject.io/en/latest/topics/releases/3006.17.html · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2025:4448-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:1012-1 · Vendor Advisory