CVE-2025-62349CWE-287
Salt Master authentication protocol downgrade may enable minion impersonation
High · published January 30, 2026
What it is
Salt contains an authentication protocol version downgrade weakness that can allow a malicious minion to bypass newer authentication/security features by using an older request payload format, enabling minion impersonation and circumventing protections introduced in response to prior issues.
The record
Technical detail
- CVSS v4.0
- 7.5 · HIGH
- Vector
- CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N
- EPSS
- 0.00463 · 39.2th percentile
- Weakness
- CWE-287 · Improper Authentication
- Published
- 2026-01-30T18:59Z
EPSS history
Timeline