Your RSA-2048 keys break in 2030. Find every one of them before attackers do.
CISA KEV·Added 2021-11-03 — agencies required to remediate by 2022-05-03
🐍 PyPI

CVE-2020-11651

CRITICAL

SaltStack Salt Unauthenticated Remote Code Execution

Also known asGHSA-pjhf-vpx3-33r3PYSEC-2020-102
Published
Apr 30, 2020
Updated
Apr 10, 2026
Affected
2 pkgs
Patched
2 / 2
Exploits
26 known

EPSS Exploitation Probability

via FIRST.org ↗
94.2%probability of exploitation in next 30 days
Very High Risk100th percentile0.00%
93.7%94.1%94.5%94.9%94.4%94.2%Dec 25Apr 26Jun 26

EPSS (Exploit Prediction Scoring System) is a daily probability model maintained by FIRST.org. It estimates the likelihood a CVE will be exploited in production environments within the next 30 days, derived from real-world threat intelligence signals.

Blast Radius

2 pkgs affected
🐍salt🐍salt

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects PyPI packages — download data is not available via public APIs for these ecosystems.

Description

An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. The salt-master process ClearFuncs class does not properly validate method calls. This allows a remote user to access some methods without authentication. These methods can be used to retrieve user tokens from the salt master and/or run arbitrary commands on salt minions.

Affected Packages

2 total 2 fixed
EcosystemPackageVulnerable rangeFix
🐍PyPIsaltall versions2019.2.4
🐍PyPIsalt≥ 3000&&< 3000.23000.2
Exploits & PoCs
26

Research use only. For defensive security, authorized penetration testing, and academic research only. Never execute exploit code against systems without explicit written authorization.

EDB-48421remotemultiple

Saltstack 3000.1 - Remote Code Execution

by Jasper Lievisse Adriaanse · May 5, 2020

Exploit-DB Source

Frequently Asked Questions

An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. The salt-master process ClearFuncs class does not properly validate method calls. This allows a remote user to access some methods without authentication. These methods can be used to retrieve user tokens from the salt master and/or run arbitrary commands on salt minions.
O3 Security · Impact-Aware SCA

Is CVE-2020-11651 in your stack?

O3 detects CVE-2020-11651 across PyPI dependencies and uses function-level reachability to confirm whether the vulnerable code path is actually reachable — not just present. No false positives.

Scan my stack How O3 SCA works