sensitive data exposure in cloud-init logs
Priority LOW 24CWE-532Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-532.
Summary
Sensitive data could be exposed in world readable logs of cloud-init before version 22.3 when schema failures are reported. This leak could include hashed passwords.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00236 14th percentileScored 2026-11-07
Fix Fixed cloud-init (Canonical Ltd.): 23.0
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Canonical | cloud-init | before 23.0 | 23.0 | Patch available | CNA |
- cloud-init VendorCanonical Affected before 23.0 Fixed in 23.0 Patch available CNA
CPE configurations NVD · 5
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:canonical:cloud-init:*:*:*:*:*:*:*:* | before 22.3 | Vulnerable | Canonical |
| cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:* | 18.04 | Vulnerable | Canonical |
| cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:* | 20.04 | Vulnerable | Canonical |
| cpe:2.3:o:canonical:ubuntu_linux:21.10:*:*:*:*:*:*:* | 21.10 | Vulnerable | Canonical |
| cpe:2.3:o:canonical:ubuntu_linux:22.04:*:*:*:lts:*:*:* | 22.04 | Vulnerable | Canonical |
- cpe:2.3:a:canonical:cloud-init:*:*:*:*:*:*:*:* Versions before 22.3 Vulnerable ·Canonical
- cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:* Versions 18.04 Vulnerable ·Canonical
- cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:* Versions 20.04 Vulnerable ·Canonical
- cpe:2.3:o:canonical:ubuntu_linux:21.10:*:*:*:*:*:*:* Versions 21.10 Vulnerable ·Canonical
- cpe:2.3:o:canonical:ubuntu_linux:22.04:*:*:*:lts:*:*:* Versions 22.04 Vulnerable ·Canonical
Remediation
- Fix · CNA cloud-init (Canonical Ltd.) Fixed in 23.0
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
Not affected: 4 products
- Red Hat Enterprise Linux 6
- Red Hat Enterprise Linux 7
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
Timeline
- 2026-10-02 Threatist record created from CVE-2022-2084
- 2026-10-03 Alias added: GHSA-w62x-qh57-5m94
References
More Canonical Cloud-init vulnerabilities
- TI-2012-05357 Improper privilege management in cloud-init CVSS 3.1HIGH 8.8
- TI-2024-05723 Improper authentication in Canonical cloud-init CVSS 3.1HIGH 8.8
- TI-2018-07709 The default cloud-init configuration, in cloud-init 0.6.2 and newer, included… CVSS 3.1HIGH 7.1
- TI-2024-10733 Incorrect permission assignment in Canonical cloud-init CVSS 3.1MEDIUM 5.9
- TI-2020-06920 In cloud-init through 19.4, rand_user_password in cloudinit/config/cc_set_passwords.py… CVSS 3.1MEDIUM 5.5
- TI-2020-06919 cloud-init through 19.4 relies on Mersenne Twister for a random password, which makes it… CVSS 3.1MEDIUM 5.5
Sources
- CVE-2022-2084 · CVE Program
- CVE-2022-2084 · NVD
- FIRST EPSS
- GHSA-w62x-qh57-5m94 · GitHub Advisory Database · CC BY 4.0
- CVE-2022-2084 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences