Any user could become root, warns Immersive Labs researcher Gareth Corfield Wed 3 Mar 2021 // 16:47 UTC Share Copy Proof of concept code has been published for a vulnerability in popular data centre security management tool Saltstack, which was discovered after a developer at Immersive Labs found a privilege escalation bug allowing any old user to become root. SaltStack offers open-source, Python-based automation tools and was acquired by VMware in October last year. Salt and pepper Last year Salt patched two CVEs – CVE-2020-11651 and CVE-2020-11652 – after researchers from F-Secure spotted an authentication bypass and a directory traversal vuln, both of which were patched at the time. Famously, the combo exposed those with Salt installations to complete control by an attacker.