CVE-2025-62349CWE-287

Salt Master authentication protocol downgrade may enable minion impersonation

High · published January 30, 2026

CVSS v4.0
7.5
EPSS
0%
Percentile
39.2
In the wild
Unconfirmed
What it is

Salt contains an authentication protocol version downgrade weakness that can allow a malicious minion to bypass newer authentication/security features by using an older request payload format, enabling minion impersonation and circumventing protections introduced in response to prior issues.

The record
Technical detail
CVSS v4.0
7.5 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N
EPSS
0.00463 · 39.2th percentile
Weakness
CWE-287 · Improper Authentication
Published
2026-01-30T18:59Z
EPSS history
Timeline
  • 30 JAN 18:59Z
    Salt Master authentication protocol downgrade may enable minion impersonation
    cvelistv5