Description
Minion event bus authorization bypass. An attacker with access to a minion key can craft a message which may be able to execute a job on other minions (>= 3007.0).
Published: 2025-06-13
Score: 8.1 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
EUVD EUVD EUVD-2025-18254 Salt has minion event bus authorization bypass vulnerability
Github GHSA Github GHSA GHSA-jh7c-xh74-h76f Salt has minion event bus authorization bypass vulnerability
History

Tue, 15 Jul 2025 13:45:00 +0000

Type Values Removed Values Added
Metrics epss

{'score': 0.0002}

 epss

{'score': 0.00024}

Fri, 13 Jun 2025 14:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-287
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Fri, 13 Jun 2025 07:15:00 +0000

Type Values Removed Values Added
Description Minion event bus authorization bypass. An attacker with access to a minion key can craft a message which may be able to execute a job on other minions (>= 3007.0).
Title CVE-2025-22236 salt advisory
References
Metrics cvssV3_1

{'score': 8.1, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:L'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: vmware

Published:

Updated: 2025-06-13T14:00:25.435Z

Reserved: 2025-01-02T04:30:06.833Z

Link: CVE-2025-22236

cve-icon Vulnrichment

Updated: 2025-06-13T14:00:21.853Z

cve-icon NVD

Status : Deferred

Published: 2025-06-13T07:15:20.863

Modified: 2026-04-15T00:35:42.020

Link: CVE-2025-22236

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses