Salt 3006.29 LTS, 3007.16 STS, 3008.4 LTS Now Available

Salt Releases 3006.29, 3007.16, and 3008.4: Responding to the eMudhra/emSign CA Incident

We’re releasing Salt 3006.29, 3007.16, and 3008.4 today in response to a certificate authority security incident affecting the broader Python ecosystem. These are narrow, targeted patch releases — each contains exactly two changes on top of the prior release in its line, nothing else.

What happened

On October 20, 2026, the Python Packaging Authority disclosed a security incident involving eMudhra’s emSign certificate authority. Independent researchers found that all eight emSign intermediate CA certificates were signed with critically weak elliptic-curve private keys — in the worst case, a private key value of d=4. A private key that weak is trivially recoverable, which means anyone who obtained it could have forged valid TLS certificates for any website and carried out man-in-the-middle attacks against connections that trusted the emSign root.

In response, the Python ecosystem moved quickly: certifi 2026.10.19 removed the emSign root from its bundled trust store, and pip 26.2.2 fixed a related issue where pip would keep trusting the compromised intermediates during its own bootstrap even after the system’s CA store had already been updated.

How this affects Salt

Salt ships both of these packages:

• certifi is Salt’s fallback trust store. Whenever Salt (or a library it depends on, like requests) makes an HTTPS connection without an explicit custom CA bundle configured, it verifies the server certificate against certifi’s bundle. Any Salt deployment on a stale certifi version kept trusting the compromised emSign root regardless of what the underlying operating system’s certificate store said.
• pip is bundled directly inside every onedir package, and a copy is embedded in the virtualenv seed wheels Salt uses to provision new virtual environments (for example, via salt-pip or any state that creates a venv). A stale pip could keep trusting the compromised intermediates during its own operations even on a fully patched host.

In short: even on a system where the OS-level CA trust store had already been fixed, a Salt installation running an older bundled certifi or pip could still be exposed.

What we fixed

Each of these three releases contains exactly two changes, cherry-picked identically across all three branches:

• Bumped certifi to 2026.10.19 (the floor in requirements/base.txt, and the exact pin in every requirements/static/pkg/* lock file used to build onedir packages).
• Bumped the pip version shipped in the onedir and virtualenv-embedded wheels to 26.2.2.

We deliberately kept these releases minimal. There are other recent fixes in Salt’s development branches — for example, an unrelated urllib3 CVE bump already shipped on the 3008.x line — but we did not bundle any of that into these patch releases. The goal was to get the narrowest possible fix for this specific incident out the door as fast as possible, without introducing unrelated changes or additional review surface into an urgent security patch.

Affected versions and upgrade guidance

We recommend upgrading to the applicable patched version as soon as possible, particularly if your Salt masters or minions:

• Make outbound HTTPS requests without an explicitly configured custom CA bundle (gitfs, the http module, salt-cloud modules, etc.)
• Use salt-pip or any state/module that provisions Python virtual environments

As always, see the full release notes for 3006.29, 3007.16, and 3008.4 for complete changelogs.

Credit

This issue originates from a third-party certificate authority, not from Salt’s own code — Salt was affected only because it bundles the certifi and pip packages whose trust decisions were compromised. Thanks to the Python Packaging Authority and the broader community for the rapid disclosure and coordinated response.

• 3006.29 LTS
  • Release Notes: View the release notes on GitHub
  • Changelogs: CHANGELOG.md
  • The Tag: Check out the official v3006.29 tag on GitHub
  • Source: PyPI - Salt 3006.29
• 3007.16 STS (Capstone)
  • Release Notes: View the release notes on GitHub
  • Changelogs: CHANGELOG.md
  • The Tag: Check out the official v3007.16 tag on GitHub
  • Source: PyPI - Salt 3007.16
• 3008.4 LTS
  • Release Notes: View the release notes on GitHub
  • Changelogs: CHANGELOG.md
  • The Tag: Check out the official v3008.4 tag on GitHub
  • Source: PyPI - Salt 3008.4

Note on 3006.x: 3006.x releases are now security fixes only. Bugfixes will no longer be backported to the 3006 LTS line, so we recommend planning your move to 3008 LTS.

Note on 3007.16: This is a Capstone release, the final release of the 3007 STS line. We recommend planning your move to a supported LTS release, 3006 LTS or 3008 LTS.

Installation & Upgrade Notes

Users can install Salt via PyPI or through our official package repositories.

• Install Guide: Refer to our official instructions for Installing Salt .

• Package Repo: Packages are available here:

  • deb
  • rpm
  • mac
  • win
  • onedir

Reporting Issues & Feedback

If you encounter any unexpected behavior, bugs, or packaging issues with these releases, please let us know right away by opening an issue:

Open a GitHub Issue

Thank you for being a vital part of the Salt Project community. Happy automating!