Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-kfjs-6e5q-j3aj
Vulnerability ID VCID-kfjs-6e5q-j3aj
Aliases CVE-2021-3144
GHSA-w2hr-3mc8-46gh
PYSEC-2021-54
Summary In SaltStack Salt before 3002.5, eauth tokens can be used once after expiration. (They might be used to run command against the salt master or minions.)
Status Published
Exploitability None
Weighted Severity None
Risk None
Affected and Fixed Packages Package Details
Weaknesses (1)
CWE-613 Insufficient Session Expiration
System Score Found at
epss 0.05481 https://api.first.org/data/v1/epss?cve=CVE-2021-3144
cvssv3.1_qr CRITICAL https://github.com/advisories/GHSA-w2hr-3mc8-46gh
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2021-3144
https://github.com/pypa/advisory-database/tree/main/vulns/salt/PYSEC-2021-54.yaml
https://github.com/saltstack/salt/blob/8f9405cf8e6f7d7776d5000841c886dec6d96250/CHANGELOG.md?plain=1#L2373
https://github.com/saltstack/salt/blob/8f9405cf8e6f7d7776d5000841c886dec6d96250/doc/topics/releases/3000.7.rst#L26
https://github.com/saltstack/salt/blob/8f9405cf8e6f7d7776d5000841c886dec6d96250/doc/topics/releases/3001.5.rst#L26
https://github.com/saltstack/salt/blob/8f9405cf8e6f7d7776d5000841c886dec6d96250/doc/topics/releases/3002.3.rst#L26
https://github.com/saltstack/salt/releases
https://lists.debian.org/debian-lts-announce/2021/11/msg00009.html
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7GRVZ5WAEI3XFN2BDTL6DDXFS5HYSDVB
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FUGLOJ6NXLCIFRD2JTXBYQEMAEF2B6XH
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YOGNT2XWPOYV7YT75DN7PS4GIYWFKOK5
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7GRVZ5WAEI3XFN2BDTL6DDXFS5HYSDVB
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7GRVZ5WAEI3XFN2BDTL6DDXFS5HYSDVB/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FUGLOJ6NXLCIFRD2JTXBYQEMAEF2B6XH
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FUGLOJ6NXLCIFRD2JTXBYQEMAEF2B6XH/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YOGNT2XWPOYV7YT75DN7PS4GIYWFKOK5
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YOGNT2XWPOYV7YT75DN7PS4GIYWFKOK5/
https://saltproject.io/security_announcements/active-saltstack-cve-release-2021-feb-25
https://saltproject.io/security_announcements/active-saltstack-cve-release-2021-feb-25/
https://security.gentoo.org/glsa/202103-01
https://security.gentoo.org/glsa/202310-22
https://www.debian.org/security/2021/dsa-5011
CVE-2021-3144 https://nvd.nist.gov/vuln/detail/CVE-2021-3144
GHSA-w2hr-3mc8-46gh https://github.com/advisories/GHSA-w2hr-3mc8-46gh
No exploits are available.
Exploit Prediction Scoring System (EPSS)
Percentile 0.9035
EPSS Score 0.05481
Published At May 30, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-05-30T20:21:22.305216+00:00 Pypa Importer Import https://github.com/pypa/advisory-database/blob/main/vulns/salt/PYSEC-2021-54.yaml 38.6.0