https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-10-05T05:05:37.168485+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/cve-2024-6174 CVE-2024-6174 2026-10-05T05:05:41.361443+00:00

Affected: Canonical cloud-init

When a non-x86 platform is detected, cloud-init grants root access to a hardcoded url with a local IP address. To prevent this, cloud-init default configurations disable platform enumeration.

 https://vulnerability.circl.lu/vuln/usn-7677-1 USN-7677-1 — cloud-init vulnerabilities 2026-10-05T05:05:41.361571+00:00

Affected: Ubuntu:Pro:16.04:LTS: cloud-init, Ubuntu:Pro:18.04:LTS: cloud-init, Ubuntu:Pro:20.04:LTS: cloud-init, Ubuntu:22.04:LTS: cloud-init, Ubuntu:24.04:LTS: cloud-init

Harry Sintonen discovered that the hotplugd socket in cloud-init was world writable. An attacker could possibly use this issue to send hotplug-hook commands. (CVE-2024-11584)

It was discovered that cloud-init granted root access to a hardcoded URL with a local IP address when a non-x86 platform is detected. An attacker could possibly impersonate an OpenStack endpoint and provide root configuration data. (CVE-2024-6174)