Reading the article in question I came across the statement:
CVE-2020-11652 allows reading files outside the intended directory and, combined with CVE-2020-11651, it makes it provides unauthenticated attackers with full read and write access and enables them to steal the secret key needed to authenticate to the salt-master server as root.
Cisco is not the first organization to announce a security breach caused by exploiting the SaltStack flaws, with digital security firm DigiCert, LineageOS, Vates (Xen Orchestra creators), and the Ghost blogging platform also reporting intrusions.
DigiCert states that NO CERTIFICATES were compromised here. Yeah, they all say that don't they? We shall see when and where the fallout begins.
Cheers