CVE-2020-11651

The vulnerability in SaltStack Salt arises from improper validation of method calls within the salt-master process, specifically in the ClearFuncs class. This flaw allows unauthorized remote users to invoke certain methods without the necessary authentication. The implications of this oversight are significant, as it enables attackers to access sensitive functionalities, including the retrieval of user tokens from the salt master. Furthermore, the vulnerability permits the execution of arbitrary commands on salt minions, which can lead to a complete compromise of the system's integrity and confidentiality.

Attack vectors exploiting this vulnerability are varied and can be executed with relative ease. An attacker with network access to the salt-master can craft requests that leverage the unvalidated method calls. By doing so, they can bypass authentication mechanisms and gain unauthorized access to critical operations. For instance, an attacker could retrieve user tokens, which may provide them with elevated privileges or access to other sensitive resources within the infrastructure. Additionally, the ability to run arbitrary commands on salt minions could allow an attacker to manipulate or exfiltrate data, deploy malware, or disrupt services, thereby amplifying the potential damage.

The real-world impact of this vulnerability is profound, particularly for organizations relying on SaltStack for configuration management and orchestration. The high CVSS score of 9.8 highlights the critical nature of the flaw, indicating that successful exploitation could lead to severe consequences. Businesses may face operational disruptions, data breaches, and reputational damage, all of which can result in significant financial losses. Furthermore, regulatory compliance issues may arise if sensitive data is exposed, leading to potential legal ramifications and fines. The interconnected nature of modern IT environments means that the repercussions of such a breach can extend beyond the immediate organization, affecting partners and customers alike.

To detect and mitigate this vulnerability, organizations should adopt a multi-faceted approach. Regularly updating SaltStack to the latest versions is crucial, as patches addressing this vulnerability have been released. Implementing strict network segmentation can also limit exposure to the salt-master, reducing the attack surface. Additionally, organizations should employ intrusion detection systems (IDS) to monitor for unusual activity or unauthorized access attempts. Conducting regular security audits and vulnerability assessments will further enhance an organization’s ability to identify and remediate potential weaknesses in their systems.

In conclusion, the vulnerability within SaltStack Salt represents a significant threat to organizations utilizing this platform for their operational needs. The ease of exploitation, coupled with the potential for severe consequences, underscores the importance of proactive security measures. By prioritizing timely updates, network security, and continuous monitoring, organizations can better safeguard their environments against the risks posed by this and similar vulnerabilities. The evolving threat landscape necessitates a vigilant and adaptive security posture to protect critical assets and maintain operational integrity.

CSURFACE threat intelligence has detected a marked escalation in the exploit landscape surrounding CVE-2020-11651, highlighted by the emergence of multiple publicly available proof-of-concept exploits and the introduction of a Metasploit module that significantly lowers the technical barrier for attackers. This development has been accompanied by the vulnerability’s formal inclusion in the CISA KEV catalog, underscoring its criticality and the urgency for defensive prioritization. The EPSS score’s substantial increase to a high-risk level reflects growing confidence in the exploitability of this vulnerability in real-world scenarios. These changes collectively indicate that threat actors now have easier access to reliable tools for remote code execution against SaltStack Salt environments, increasing the likelihood of widespread exploitation. Consequently, the threat level has escalated from theoretical to imminent, necessitating heightened vigilance as adversaries can more readily leverage this vulnerability for lateral movement, credential theft, or command execution on affected systems.

Update 2 — April 17, 2026

CSURFACE threat intelligence has detected a marked escalation in exploitation attempts targeting CVE-2020-11651, with initial confirmed sightings emerging after a prolonged period of low activity. This development coincides with the sustained availability of multiple proof-of-concept exploits on public repositories, which continue to attract community engagement and facilitate adversary access to reliable attack tools. Although the EPSS score remains stable at a high level, the appearance of active exploitation signals a shift from theoretical risk to practical threat, underscoring the vulnerability’s exploitation viability in operational environments. For defenders, this escalation signifies an increased urgency to monitor SaltStack Salt deployments closely, as threat actors are now more likely to leverage this vulnerability for unauthorized command execution and credential theft. The threat level has consequently risen to a heightened state of alert, reflecting the growing confidence and capability of attackers to exploit this critical flaw in real-world scenarios.

Update 3 — June 23, 2026

CSURFACE threat intelligence has detected a marked escalation in exploitation activity targeting CVE-2020-11651, accompanied by the emergence of several new proof-of-concept tools that lower the barrier for adversaries to weaponize this vulnerability. Our telemetry indicates that attackers are increasingly leveraging these publicly available exploits to execute unauthorized commands and extract sensitive credentials from SaltStack Salt deployments. This trend is reflected in a rising EPSS score, signaling growing exploit likelihood and reinforcing the vulnerability’s operational relevance. The expanded exploit landscape and heightened detection frequency underscore a shift toward more frequent and sophisticated attacks, elevating the risk posture for organizations running vulnerable SaltStack Salt versions. Consequently, the threat level associated with CVE-2020-11651 has intensified, demanding heightened vigilance as threat actors demonstrate enhanced capability and intent to exploit this critical flaw in real-world environments.