TI-2024-05723 Aliases CVE-2024-6174 GHSA-w8g9-wp36-fchj

Improper authentication in Canonical cloud-init

MEDIUM 40CWE-287Published 2025-06-26 · Updated 2025-06-26

Key facts

Attack vector: Adjacent network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: High · High · High
Fix status: Partial Red Hat: 11 fixed, 1 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-287.

Summary

When a non-x86 platform is detected, cloud-init grants root access to a hardcoded url with a local IP address. To prevent this, cloud-init default configurations disable platform enumeration.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00266 18th percentileScored 2026-11-07

Fix Partial cloud-init (Canonical): 25.1.3Red Hat: 8 advisoriesRed Hat: 11 fixed, 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Canonical	cloud-init	0.7.9 to before 25.1.3	25.1.3	Patch available	CNA

cloud-init VendorCanonical Affected 0.7.9 to before 25.1.3 Fixed in 25.1.3 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:canonical:cloud-init::::::::	before 25.1.3	Vulnerable	Canonical

cpe:2.3:a:canonical:cloud-init:*:*:*:*:*:*:*:* Versions before 25.1.3 Vulnerable ·Canonical

Remediation

Fix · CNA cloud-init (Canonical) Fixed in 25.1.3

Red Hat 8 advisories

RHSA-2025:11339 Released 2025-07-16 · Red Hat rating Important
cloud-init security update
- Red Hat Enterprise Linux AppStream E4S (v.8.8) cloud-init-22.1-8.el8_8.2
- Red Hat Enterprise Linux AppStream TUS (v.8.8) cloud-init-22.1-8.el8_8.2
RHSA-2025:11337 Released 2025-07-16 · Red Hat rating Important
cloud-init security update
- Red Hat Enterprise Linux AppStream AUS (v.8.6) cloud-init-21.1-15.el8_6.4
- Red Hat Enterprise Linux AppStream E4S (v.8.6) cloud-init-21.1-15.el8_6.4
- Red Hat Enterprise Linux AppStream TUS (v.8.6) cloud-init-21.1-15.el8_6.4
RHSA-2025:11324 Released 2025-07-16 · Red Hat rating Important
cloud-init security update
- Red Hat Enterprise Linux AppStream (v. 8) cloud-init-23.4-7.el8_10.10

Show 5 more Red Hat advisories

RHSA-2025:11295 Released 2025-07-16 · Red Hat rating Important
cloud-init security update
- Red Hat Enterprise Linux AppStream E4S (v.9.0) cloud-init-21.1-19.el9_0.7
RHSA-2025:10876 Released 2025-07-14 · Red Hat rating Important
cloud-init security update
- Red Hat Enterprise Linux AppStream EUS (v.9.4) cloud-init-23.4-7.el9_4.13
RHSA-2025:10879 Released 2025-07-14 · Red Hat rating Important
cloud-init security update
- Red Hat Enterprise Linux AppStream E4S (v.9.2) cloud-init-22.1-10.el9_2.1
RHSA-2025:10848 Released 2025-07-14 · Red Hat rating Important
cloud-init security update
- Red Hat Enterprise Linux AppStream (v. 9) cloud-init-24.4-4.el9_6.3
RHSA-2025:10844 Released 2025-07-14 · Red Hat rating Important
cloud-init security update
- Red Hat Enterprise Linux AppStream (v. 10) cloud-init-24.4-3.el10_0.2

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2025-06-26
Canonical cloud-init 25.1.3
2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW
Other records, highest priority first
- TI-2024-10733 Incorrect permission assignment in Canonical cloud-initPriority LOW 25
Show all 2 records →

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

Product	Status	Plan or fix
Red Hat Enterprise Linux 7	Affected	No fix planned: Out of support scope
Red Hat Enterprise Linux AppStream (v. 10)	Fixed	RHSA-2025:10844
Red Hat Enterprise Linux AppStream (v. 8)	Fixed	RHSA-2025:11324
Red Hat Enterprise Linux AppStream (v. 9)	Fixed	RHSA-2025:10848
Red Hat Enterprise Linux AppStream AUS (v.8.6)	Fixed	RHSA-2025:11337
Red Hat Enterprise Linux AppStream E4S (v.8.6)	Fixed	RHSA-2025:11337
Red Hat Enterprise Linux AppStream E4S (v.8.8)	Fixed	RHSA-2025:11339
Red Hat Enterprise Linux AppStream E4S (v.9.0)	Fixed	RHSA-2025:11295
Red Hat Enterprise Linux AppStream E4S (v.9.2)	Fixed	RHSA-2025:10879
Red Hat Enterprise Linux AppStream EUS (v.9.4)	Fixed	RHSA-2025:10876
Red Hat Enterprise Linux AppStream TUS (v.8.6)	Fixed	RHSA-2025:11337
Red Hat Enterprise Linux AppStream TUS (v.8.8)	Fixed	RHSA-2025:11339

Timeline

2026-10-02 Threatist record created from CVE-2024-6174
2026-10-03 Alias added: GHSA-w8g9-wp36-fchj

References

Other 1

https://github.com/canonical/cloud-init/releases/tag/25.1.3

TI-2012-05357 Improper privilege management in cloud-init CVSS 3.1HIGH 8.8
TI-2018-07709 The default cloud-init configuration, in cloud-init 0.6.2 and newer, included… CVSS 3.1HIGH 7.1
TI-2024-10733 Incorrect permission assignment in Canonical cloud-init CVSS 3.1MEDIUM 5.9
TI-2020-06920 In cloud-init through 19.4, rand_user_password in cloudinit/config/cc_set_passwords.py… CVSS 3.1MEDIUM 5.5
TI-2020-06919 cloud-init through 19.4 relies on Mersenne Twister for a random password, which makes it… CVSS 3.1MEDIUM 5.5
TI-2023-01678 sensitive data exposure in cloud-init logs CVSS 3.1MEDIUM 5.5

See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences