CVE-2022-2084: Canonical Cloud-Init

Medium severity, CVSS 5.5. EPSS: 0.2% chance of exploitation in the next 30 days.

Sensitive data could be exposed in world readable logs of cloud-init before version 22.3 when schema failures are reported. This leak could include hashed passwords.

Affected products

• Canonical Cloud-Init: before 22.3 (fixed in 22.3)
• Canonical Ubuntu Linux: version 18.04 only; version 20.04 only; version 21.10 only; version 22.04 only

Published 2023-04-19. Last modified 2026-06-17.