Rated critical, the vulnerabilities, tracked as CVE-2020-11651 and CVE-2020-11652, were made public at the end of April, when SaltStack patches were released. The issue, however, only appears when unsecure settings are used.
The popular configuration tool uses a Salt Master to collect reports from agents called minions, and to deliver messages (configuration updates) to them. Typically, the Salt Master is not connected to the Internet, but roughly 6,000 instances were found exposed at the end of April.
