https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-23T19:55:10.955266+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cnvd-2017-34863 cnvd-2017-34863 2026-10-23T19:55:11.067001+00:00 cnvd-2017-34863 https://cve.radiocsirt.org/vuln/euvd-2026-73153 EUVD-2026-73153 2026-10-23T19:55:11.067052+00:00 EUVD-2026-73153 https://cve.radiocsirt.org/vuln/fkie_cve-2017-5192 fkie_cve-2017-5192 2026-10-23T19:55:11.067069+00:00

When using the local_batch client from salt-api in SaltStack Salt before 2015.8.13, 2016.3.x before 2016.3.5, and 2016.11.x before 2016.11.2, external authentication is not respected, enabling all authentication to be bypassed.

 https://cve.radiocsirt.org/vuln/ghsa-f2h7-4f84-8qrm GHSA-f2h7-4f84-8qrm — SaltStack Salt Authentication Bypass when using the local_batch client from salt-api 2026-10-23T19:55:11.067101+00:00

Affected: PyPI: salt

When using the local_batch client from salt-api in SaltStack Salt before 2015.8.13, 2016.3.x before 2016.3.5, and 2016.11.x before 2016.11.2, external authentication is not respected, enabling all authentication to be bypassed.

 https://cve.radiocsirt.org/vuln/gsd-2017-5192 gsd-2017-5192 2026-10-23T19:55:11.067128+00:00 gsd-2017-5192 https://cve.radiocsirt.org/vuln/pysec-2017-38 PYSEC-2017-38 2026-10-23T19:55:11.067141+00:00

Affected: PyPI: salt

When using the local_batch client from salt-api in SaltStack Salt before 2015.8.13, 2016.3.x before 2016.3.5, and 2016.11.x before 2016.11.2, external authentication is not respected, enabling all authentication to be bypassed.

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2017-5192 UBUNTU-CVE-2017-5192 2026-10-23T19:55:11.067159+00:00

Affected: Ubuntu:Pro:14.04:LTS: salt, Ubuntu:Pro:16.04:LTS: salt

When using the local_batch client from salt-api in SaltStack Salt before 2015.8.13, 2016.3.x before 2016.3.5, and 2016.11.x before 2016.11.2, external authentication is not respected, enabling all authentication to be bypassed. The LocalClient.cmd_batch() method client does not accept external_auth credentials and so access to it from salt-api has been removed for now. This vulnerability allows code execution for already-authenticated users and is only in effect when running salt-api as the root user.