FlawAtlas
Search the atlas
CVE-2021-25281 Critical

CVE-2021-25281

An issue was discovered in through SaltStack Salt before 3002.5. salt-api does not honor eauth credentials for the wheel_async client. Thus, an attacker can remotely run any wheel modules on the master.

Exploit probability 73.1%
Published February 27, 2021
Required by Not available
Last source change June 10, 2026

02 / AFFECTED SOFTWARE

Affected packages

Unknown Unknown

95 explicit affected versions

PyPI salt

159 explicit affected versions

PyPI salt

168 explicit affected versions

03 / CONNECTIONS

Connected vulnerabilities

04 / EVIDENCE

Source records

Open Source Vulnerabilities CVE-2021-25281

An issue was discovered in through SaltStack Salt before 3002.5. salt-api does not honor eauth credentials for the wheel_async client. Thus, an attacker can remotely run any wheel modules on the master.

View original source
Open Source Vulnerabilities PYSEC-2021-50

An issue was discovered in through SaltStack Salt before 3002.5. salt-api does not honor eauth credentials for the wheel_async client. Thus, an attacker can remotely run any wheel modules on the master.

View original source
Open Source Vulnerabilities GHSA-xxw3-765m-f37p

An issue was discovered in through SaltStack Salt before 3002.5. salt-api does not honor eauth credentials for the wheel_async client. Thus, an attacker can remotely run any wheel modules on the master.

View original source

05 / REFERENCES

Further evidence