Is CVE-2020-11652 (SaltStack Salt Path Traversal) being exploited in the wild?

What “being exploited in the wild” means for this CVE

For this case, the practical question is not whether the flaw exists, but whether defenders should assume real-world abuse is already happening. CISA’s KEV inclusion is the strongest operational signal for that, because it reflects confirmed active exploitation rather than theoretical impact. That should move the issue into urgent remediation, exposure validation, and compromise review.

An actively exploited path traversal in a management plane is especially important because attackers often target the component that can reach the most sensitive directories or control functions. The issue is not only file access, but the trust placed in a privileged service process that can expose more than a normal application endpoint.

For background on how KEV-driven triage should be handled, see Zero-Day and Exploited Vulnerabilities Guide, which frames active exploitation, emergency mitigation, and post-patch hunting as a single response cycle.

The authoritative references for confirmation are the CISA Known Exploited Vulnerabilities Catalog and the CVE Program. Use those sources to validate the identifier and the exploitation status, then align your internal response window to the remediation urgency implied by KEV listing.

How to confirm exposure before you patch

Start by determining whether SaltStack Salt is present in the environment at all, and whether any salt-master instance is reachable from networks or users that should not have that level of access. A KEV-listed issue should trigger asset inventory review, not just patch scheduling, because organisations often underestimate how many management nodes exist outside the main server estate.

If the product is deployed, verify whether the vulnerable service is internet-facing, exposed to broad internal access, or reachable from environments with weaker segmentation. That exposure analysis matters because path traversal becomes much more dangerous when the service sits behind trusted administrative boundaries or can interact with sensitive local files.

The same exposure review should include logging and authentication traces around the salt-master process, especially for unusual directory access attempts, abnormal request patterns, and any access that does not fit normal administrative workflows. For a broader prioritisation model, the Vulnerability Management Guide is useful for sequencing scope, prioritisation, verification, and exception handling around exploited flaws.

For external prioritisation, compare the KEV status with exploit-likelihood signals such as FIRST EPSS, but do not let a score outrank confirmed exploitation. In this situation, real-world abuse evidence should dominate triage.

What to do if patching is delayed

If immediate remediation is blocked, reduce the reachable attack surface first. Restrict network access to the salt-master process, isolate administrative paths, and limit which operators, systems, and segments can interact with the service. Temporary containment is not a substitute for fixing the flaw, but it can lower the chance of further abuse while change control catches up.

When a management service is exposed to potential path traversal, compensating controls should focus on constraining where the service can read, write, and execute, not just on perimeter filtering. Strong segmentation, host hardening, and tight administrative access paths are the most meaningful short-term mitigations.

Once patching is complete, verify that the service is no longer exposed through weak routes and that no local files were accessed unexpectedly before remediation. The NIST National Vulnerability Database can help with record reconciliation and downstream tracking, while the vendor advisory should remain the primary source for version-specific fix details.

Where the flaw may have exposed configuration, credentials, or operational scripts, rotate anything that could have been read or reused by an attacker. In a control plane like Salt, file access can have indirect consequences even when the initial issue looks like a directory traversal problem rather than a classic credential theft event.

Risk and Threat Considerations

Actively exploited path traversal in a privileged orchestration component can expose configuration files, secrets, command inputs, or other sensitive local data. The security concern is not limited to unauthorized file reads, because management tooling often sits close to the systems that control scale, automation, and privileged change.

Failure mechanism: An attacker abuses traversal in the salt-master ClearFuncs path handling to access directories or files they should not reach, then uses the recovered information to deepen access or prepare follow-on activity.

Impact: Exposure can extend beyond one host if the service stores reusable credentials, automation material, or operational data that supports broader environment control, making initial exploitation a gateway to lateral movement or privileged misuse.

Practitioner Guidance

What to prioritise: Treat confirmed KEV status as a remediation queue jump, then verify whether the service is externally reachable, internally overexposed, or able to touch sensitive files that would raise blast radius.

What to verify: Check for directory access anomalies, unusual salt-master requests, and any evidence that sensitive configuration or secret material was accessed before the fix. If that evidence exists, escalate into compromise assessment rather than stopping at patching.

Practitioner takeaway: For exploited infrastructure flaws, the right decision is usually to assume exposure first and prove absence of compromise second, because active exploitation changes both urgency and the scope of what must be checked.

Related resources from NHI Mgmt Group

• CVE-2020-11652 (SaltStack Salt Path Traversal)
• Is CVE-2020-1631 (Juniper Junos OS Path Traversal) being exploited in the wild?
• Is CVE-2024-13159 (Ivanti Endpoint Manager (EPM) Absolute Path Traversal) being exploited in the wild?
• Is CVE-2023-35081 (Ivanti Endpoint Manager Mobile (EPMM) Path Traversal) being exploited in the wild?