CVE-2021-25281: An issue was discovered in through SaltStack Salt before 3002.5.

Security readout for executives and security teams

SaltStack Salt before 3002.5 had a salt-api authorization flaw. A remote attacker could use the wheel_async client without valid eauth enforcement and run master-side wheel modules. For organizations using Salt as infrastructure control plane, compromise could affect managed systems and automation trust. Exposure is likely where salt-api is enabled and reachable, especially if connected to a Salt master running versions before 3002.5 or unpatched distribution packages. Systems without salt-api exposure are less directly exposed based on the provided evidence. Prioritize remediation where Salt controls production infrastructure or cloud automation. This is control-plane risk: compromise of the master can affect many downstream systems, even though active exploitation is not proven in the supplied sources. Mitigation focus: Upgrade Salt to 3002.5 or a vendor-fixed package.; Apply relevant Fedora, Debian, or Gentoo security updates where applicable.; Restrict salt-api network access to trusted management networks..

Prepared

Jun 3, 2026, 03:04 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.