SaltStack Salt through 3002 allows an unauthenticated user with network access to the Salt API to use shell injections to run code on the Salt-API using the SSH client.
View the template here CVE-2020-16846.yaml
References:
https://saltproject.io/on-november-3-2020-saltstack-publicly-disclosed-three-new-cves/