{"schema":"threatline.record/2","record":{"id":"CVE-2020-16846","aliases":[],"summary":"SaltStack Salt Shell Injection Vulnerability","details":"SaltStack Salt allows an unauthenticated user with network access to the Salt API to use shell injections to run code on the Salt API using the SSH client. This vulnerability affects any users running the Salt API.","categories":["Unclassified"],"product":"Salt","vendor":"SaltStack","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2020-16846","source_modified_at":"2025-10-21T23:35:33.124Z","fetched_at":"2026-10-23T18:42:43.628194Z","product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}],"defaultStatus":null}],"fixed_versions":[],"cvss":9.8,"severity":"Critical","kev":{"listed":true,"date_added":"2021-11-03","due_date":"2022-05-03","required_action":"Apply updates per vendor instructions.","ransomware_campaign_use":"Unknown"},"epss":{"probability":0.99585,"percentile":0.99947,"score_date":"2026-10-23"},"published_at":"2020-11-06T07:27:24.000Z","modified_at":"2025-10-21T23:35:33.124Z","provenance":[{"source":"CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23T17:00:09.9001Z"},{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2020-16846","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2025-10-21T23:35:33.124Z"},{"source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/saltstack_salt_api_cmd_exec.rb","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2020-11-03"},{"source":"Nuclei","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-16846.yaml","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":null},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2020-16846","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CISA KEV","CVE List","Metasploit","Nuclei","EPSS"],"references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-16846","source":"CISA KEV"},{"source":"CVE List","url":"https://github.com/saltstack/salt/releases","tags":["x_refsource_MISC","x_transferred"]},{"source":"CVE List","url":"https://www.saltstack.com/blog/on-november-3-2020-saltstack-publicly-disclosed-three-new-cves/","tags":["x_refsource_CONFIRM","x_transferred"]},{"source":"CVE List","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TPOGB2F6XUAIGFDTOCQDNB2VIXFXHWMA/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred"]},{"source":"CVE List","url":"https://security.gentoo.org/glsa/202011-13","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred"]},{"source":"CVE List","url":"https://www.zerodayinitiative.com/advisories/ZDI-20-1381/","tags":["x_refsource_MISC","x_transferred"]},{"source":"CVE List","url":"https://www.zerodayinitiative.com/advisories/ZDI-20-1383/","tags":["x_refsource_MISC","x_transferred"]},{"source":"CVE List","url":"https://www.zerodayinitiative.com/advisories/ZDI-20-1380/","tags":["x_refsource_MISC","x_transferred"]},{"source":"CVE List","url":"https://www.zerodayinitiative.com/advisories/ZDI-20-1379/","tags":["x_refsource_MISC","x_transferred"]},{"source":"CVE List","url":"https://www.zerodayinitiative.com/advisories/ZDI-20-1382/","tags":["x_refsource_MISC","x_transferred"]},{"source":"CVE List","url":"https://lists.debian.org/debian-lts-announce/2020/12/msg00007.html","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"source":"CVE List","url":"https://www.debian.org/security/2021/dsa-4837","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred"]},{"source":"CVE List","url":"https://lists.debian.org/debian-lts-announce/2022/01/msg00000.html","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"source":"CVE List","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-16846","tags":["government-resource"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CISA ADP","ssvc":{"exploitation":"active","automatable":"yes","technical_impact":"total","assessed_at":"2025-02-07T13:49:59.119196Z"},"exploits":[{"source":"Metasploit","kind":"Exploit module","name":"SaltStack Salt REST API Arbitrary Command Execution","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/saltstack_salt_api_cmd_exec.rb","date":"2020-11-03","added":"2025-12-17","check":true},{"source":"Nuclei","kind":"Scanner template","name":"SaltStack <=3002 - Shell Injection","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-16846.yaml"}],"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2025-10-21T23:35:33.124Z","content_hash":"c333c355eb4f818629a1acb946c4df68338155b2ac4a4f86bcdc2010181402d3"}}