CVE Tools
Track your stack

Cloud-init

9 CVEs tracked. None of them is in CISA KEV.

This hub aggregates every CVE we track for Cloud-init, a product in the operating systems space. Use it to gauge the current risk picture and drill into individual advisories.

Cloud-init CVEs per month

Dec 2024 to Nov 2026. Point at a month, or focus the strip and use the arrow keys.
Cloud-init CVEs per month
MonthCVEs
2024-120
2025-010
2025-020
2025-030
2025-040
2025-050
2025-062
2025-070
2025-080
2025-090
2025-100
2025-110
2025-120
2026-010
2026-020
2026-030
2026-040
2026-050
2026-060
2026-070
2026-080
2026-090
2026-100
2026-110

Severity

How the 9 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.

  • High333%
  • Medium667%

Latest CVEs

The 9 most recently published vulnerabilities affecting Cloud-init.

  1. CVE-2024-11584cloud-init through 25.1.2 includes the systemd socket unit cloud-init-hotplugd.socket with default SocketMode that grants 0666 permissions, making it world-writable. This is used for the "/run...5.9
  2. CVE-2024-6174When a non-x86 platform is detected, cloud-init grants root access to a hardcoded url with a local IP address. To prevent this, cloud-init default configurations disable platform enumeration.8.8
  3. CVE-2023-1786sensitive data exposure in cloud-init logs5.5
  4. CVE-2022-2084sensitive data exposure in cloud-init logs5.5
  5. CVE-2021-3429sensitive data exposure in cloud-init logs5.5
  6. CVE-2020-8632In cloud-init through 19.4, rand_user_password in cloudinit/config/cc_set_passwords.py has a small default pwlen value, which makes it easier for attackers to guess passwords.5.5
  7. CVE-2020-8631cloud-init through 19.4 relies on Mersenne Twister for a random password, which makes it easier for attackers to predict passwords, because rand_str in cloudinit/util.py calls the random.choice fun...5.5
  8. CVE-2012-6639An privilege elevation vulnerability exists in Cloud-init before 0.7.0 when requests to an untrusted system are submitted for EC2 instance data.8.8
  9. CVE-2018-10896The default cloud-init configuration, in cloud-init 0.6.2 and newer, included "ssh_deletekeys: 0", disabling cloud-init's deletion of ssh host keys. In some environments, this could lead to instanc...7.1

Product grouping is registry-driven, with AI assist and human review. How it works