https://saltproject.io/tags/security/Recent content in Security on Salt ProjectHugoen-usFri, 10 Jul 2026 00:00:00 +0000https://saltproject.io/blog/2026-07-10-website-facelift/Fri, 10 Jul 2026 00:00:00 +0000https://saltproject.io/blog/2026-07-10-website-facelift/The Salt Project website has a new look as part of a broader theme unification across the Salt Project website and documentation, bringing a single unified blog feed, local search, and tag-based filtering. These updates also include updates to how the RSS feeds work, such as the security feed.https://saltproject.io/blog/2026-04-29-advisory/Wed, 29 Apr 2026 00:00:00 +0000https://saltproject.io/blog/2026-04-29-advisory/Due to a supply chain incident, Salt has rotated secrets and initiated the revocation of compromised macOS DeveloperID signing certificates.https://saltproject.io/blog/2025-11-20-advisory-3006-17-3007-9/Thu, 20 Nov 2025 00:00:00 +0000https://saltproject.io/blog/2025-11-20-advisory-3006-17-3007-9/The Salt Project is announcing the Salt 3006.17 LTS and 3007.9 STS CVE releases. This release addresses 2 CVEs, ranging from low to medium in severity.https://saltproject.io/blog/2025-06-12-advisory-3006-12-3007-4/Thu, 12 Jun 2025 00:00:00 +0000https://saltproject.io/blog/2025-06-12-advisory-3006-12-3007-4/The Salt Project is announcing the Salt 3006.12 LTS and 3007.4 STS CVE releases. This release addresses 11 CVEs, ranging from low to critical in severity.https://saltproject.io/blog/salt-release-3006-9-is-now-available/Tue, 30 Jul 2024 00:00:00 +0000https://saltproject.io/blog/salt-release-3006-9-is-now-available/The Salt Project is announcing the Salt 3006.9 LTS bugfix release. This bugfix release includes at least one CVE fix (low to medium risk).https://saltproject.io/blog/2024-01-31-advisory/Wed, 31 Jan 2024 00:00:00 +0000https://saltproject.io/blog/2024-01-31-advisory/The Salt Project released a security update to Salt to address 2 vulnerabilities with a severity rating of High and Medium. We strongly recommend prioritizing this update. This is a security advisory release.https://saltproject.io/blog/2024-01-30-advisory/Tue, 30 Jan 2024 00:00:00 +0000https://saltproject.io/blog/2024-01-30-advisory/Some High and Medium severity vulnerabilities have been discovered in Salt versions 3006.5 and earlier. The vulnerabilities are high and medium severity based on the common Vulnerability Scoring System (CVSS).https://saltproject.io/blog/2023-10-27-advisory/Fri, 27 Oct 2023 00:00:00 +0000https://saltproject.io/blog/2023-10-27-advisory/The Salt Project released a security update to Salt to address 1 vulnerability with a severity rating of Medium. We strongly recommend prioritizing this update. This is a security advisory release.https://saltproject.io/blog/2023-10-26-advisory/Thu, 26 Oct 2023 00:00:00 +0000https://saltproject.io/blog/2023-10-26-advisory/A Medium severity vulnerability has been discovered in Salt versions 3006.3 and earlier. The vulnerability is Medium severity based on the common Vulnerability Scoring System (CVSS).https://saltproject.io/blog/2023-08-10-advisory/Thu, 10 Aug 2023 00:00:00 +0000https://saltproject.io/blog/2023-08-10-advisory/The Salt Project released a security update to Salt to address 2 vulnerabilities with a severity rating of Medium. We strongly recommend prioritizing this update. This is a security advisory release.https://saltproject.io/blog/2023-08-09-advisory/Wed, 09 Aug 2023 00:00:00 +0000https://saltproject.io/blog/2023-08-09-advisory/Some medium severity vulnerabilities have been discovered in Salt versions 3006.1 and earlier. The vulnerabilities are medium severity based on the common Vulnerability Scoring System (CVSS).https://saltproject.io/blog/salt-3005-1-4-security-package-update/Tue, 10 Jan 2023 00:00:00 +0000https://saltproject.io/blog/salt-3005-1-4-security-package-update/The Salt Project has released v3005.1-4 packages. This release only impacts the onedir packages and the classic Windows and Mac packages.https://saltproject.io/blog/2022-06-21-advisory/Tue, 21 Jun 2022 00:00:00 +0000https://saltproject.io/blog/2022-06-21-advisory/The Salt Project released a security update to Salt to address 1 vulnerability with severity rating High. If you are using PAM authentication from within Salt, we strongly recommend prioritizing this update. This is a security advisory release. This release includes fixes to the vulnerability and bug fixes from the previous CVE release.https://saltproject.io/blog/2022-06-13-advisory/Mon, 13 Jun 2022 00:00:00 +0000https://saltproject.io/blog/2022-06-13-advisory/A critical vulnerability has been discovered in Salt versions 3004.1 and earlier. The vulnerability rating is high based on the Common Vulnerability Scoring System (CVSS).https://saltproject.io/blog/2022-03-28-advisory/Mon, 28 Mar 2022 00:00:00 +0000https://saltproject.io/blog/2022-03-28-advisory/The Salt Project released a security update to Salt to address 4 vulnerabilities with a severity rating of Medium to High. We strongly recommend prioritizing this update. This is a security advisory release.https://saltproject.io/blog/2022-03-22-advisory/Tue, 22 Mar 2022 00:00:00 +0000https://saltproject.io/blog/2022-03-22-advisory/Some critical vulnerabilities have been discovered in Salt versions 3004 and earlier. The vulnerabilities range in rating from Medium to High based on the Common Vulnerability Scoring System (CVSS). We are preparing a CVE release to be available on Monday, March 28th.https://saltproject.io/blog/2021-09-21-advisory/Thu, 02 Sep 2021 00:00:00 +0000https://saltproject.io/blog/2021-09-21-advisory/The Salt Project released a security update to Salt to address 3 vulnerabilities with severity rating Medium to High. We strongly recommend prioritizing this update. This is a security advisory release.https://saltproject.io/blog/2021-02-25-advisory-02/Thu, 25 Feb 2021 13:43:40 +0000https://saltproject.io/blog/2021-02-25-advisory-02/The Salt Project has released a security update to address 10 vulnerabilities with severity rating Medium to High. We strongly recommend prioritizing this update.https://saltproject.io/blog/2021-02-25-advisory-01/Thu, 25 Feb 2021 10:43:40 +0000https://saltproject.io/blog/2021-02-25-advisory-01/Today the 2021-FEB-25 CVE Release is on-going and we are working through tasks. However, it is taking longer than expected. At this time we estimate a release time as 6 PM MST and 1 AM UTC. We apologize for the delay.https://saltproject.io/blog/2021-02-04-advisory/Thu, 04 Feb 2021 00:00:00 +0000https://saltproject.io/blog/2021-02-04-advisory/Today’s scheduled CVE Release is delayed due to a bug found late in the release cycle. This CVE Release is now set for Thursday, February 25th, 2021 by noon MST and 7:00 PM UTC. We apologize for the inconvenience this delay causes.https://saltproject.io/blog/2021-01-29-advisory/Fri, 29 Jan 2021 00:00:00 +0000https://saltproject.io/blog/2021-01-29-advisory/Several critical vulnerabilities have been discovered in Salt. These affect versions 3002 and earlier.Most of these, we expect the Common Vulnerability Scoring System (CVSS) rating to be high or critical. We quickly took actions to remediate once made aware of the vulnerabilities.https://saltproject.io/blog/2020-11-02-advisory/Tue, 03 Nov 2020 00:00:00 +0000https://saltproject.io/blog/2020-11-02-advisory/SaltStack has released a security update to Salt to address three critical vulnerabilities. We strongly recommend that you prioritize this update.https://saltproject.io/blog/2020-10-30-advisory/Fri, 30 Oct 2020 00:00:00 +0000https://saltproject.io/blog/2020-10-30-advisory/Three related critical vulnerabilities have been discovered in Salt versions 3002 and earlier.https://saltproject.io/blog/2020-05-06-advisory/Wed, 06 May 2020 00:00:00 +0000https://saltproject.io/blog/2020-05-06-advisory/We have created and made patches available for a number of Salt releases. Some patches are specific to certain Salt versions and, as noted, some will patch multiple versions. To ensure the patch is effective, verify installation of your version prior to installing any patches.https://saltproject.io/blog/2020-05-04-advisory/Mon, 04 May 2020 00:00:00 +0000https://saltproject.io/blog/2020-05-04-advisory/Last week a critical vulnerability was discovered affecting Salt Master versions 2019.2.3 and 3000.1 and earlier. SaltStack customers and Salt users who have followed fundamental internet security guidelines and best practices are not affected by this vulnerability. The vulnerability is easily exploitable if a Salt Master is exposed to the open internet.https://saltproject.io/blog/2020-04-21-advisory/Tue, 21 Apr 2020 00:00:00 +0000https://saltproject.io/blog/2020-04-21-advisory/We have decided to proceed with release packages for 2019.2.5 and 3000.3 that contain fixes to these new these critical CVEs (CVE-2020-11651 and CVE-2020-11652). The packages will be available Wednesday, May 13, or potentially sooner.