EUVD-2025-18254

SaltStack's event bus is the core messaging layer that coordinates communication between the Salt master and minions. The vulnerability stems from improper authorization validation (CWE-287: Improper Authentication) in the event bus message handling logic, specifically in versions >= 3007.0. The event bus processes job execution requests, and the authorization bypass allows an attacker holding a valid minion key to forge messages that bypass normal authentication/authorization checks. Rather than validating that a message sender is authorized to execute jobs on target minions, the bus accepts crafted messages from any authenticated minion. This is a broken access control issue where message origin authentication exists but message intent authorization does not. The affected component is libsaltstack/minion/event_bus (or equivalent internal module handling inter-minion communication). CPE notation would be: cpe:2.3:a:saltstack:salt:*:*:*:*:*:*:*:* (versions 3007.0 and later).