In SaltStack Salt before 2016.3.6, compromised salt-minions can impersonate the salt-master.
"https://github.com/pypa/advisory-database/blob/main/vulns/salt/PYSEC-2018-50.yaml"