CVE-2023-1786: Canonical Cloud-Init

Medium severity, CVSS 5.5. EPSS: 0.3% chance of exploitation in the next 30 days.

Sensitive data could be exposed in logs of cloud-init before version 23.1.2. An attacker could use this information to find hashed passwords and possibly escalate their privilege.

Affected products

• Canonical Cloud-Init: before 23.1.2 (fixed in 23.1.2)
• Canonical Ubuntu Linux: version 16.04 only; version 18.04 only; version 20.04 only; version 22.04 only; version 22.10 only; version 23.04 only
• Fedoraproject Fedora: version 38 only

Published 2023-04-26. Last modified 2026-06-17.