Kaspersky details cloud chain with SQL injection

Kaspersky Securelist published an analysis of a vulnerability chain in a cloud infrastructure that included SQL injection in a custom Salt master script. According to the report, the flaw allowed access to database schemas with metadata on managed resources and Salt master authentication tokens.

What did Kaspersky describe?

Securelist’s analysis said the chain of failures affected a cloud infrastructure and opened the door to sensitive administrative data. Among the exposed elements, the publication said, were metadata tied to managed resources and authentication tokens associated with Salt masters.

The investigation focused on a SQL injection vulnerability in a custom Salt master script. Kaspersky said that component was one of the points that let an attacker move deeper into the infrastructure and reach database schemas with information valuable to the managed environment.

What does the secondary analysis add?

The Layman Security published a secondary analysis that describes the chain as a bypass of tenant isolation, but that reconstruction has not been independently corroborated. The note attributes the account to Kaspersky and adds technical details that were not confirmed by another primary source.

That analysis mentions a D-Bus socket in the control plane, local privilege escalation through OverlayFS linked to CVE-2023-32629, a shared overlay network and Salt minion keys. It also says Kaspersky did not identify the cloud provider and that researchers did not finish taking over all resources because they stopped that phase by agreement with the provider.

What remains unconfirmed?

The reference to Valkey CVE-2026-25243 still lacks sufficient support in the available material. The Layman Security included it in the chain, but the search did not find an official advisory or independent evidence tying it to this specific case.

Based on the material provided, the report supports the existence of a cloud administration failure chain that exposed metadata and credentials, although it does not identify a commercial provider affected or confirm a specific impact on companies in Latin America.