CVE-2023-1786 sensitive data exposure in cloud-init logs
Attackers can read sensitive data like hashed passwords from cloud-init logs, potentially leading to privilege escalation.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-1786?
CVE-2023-1786 is a medium-severity vulnerability in Canonical Ubuntu Linux, published on 26 Apr 2023. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Sensitive data could be exposed in logs of cloud-init before version 23.1.2. An attacker could use this information to find hashed passwords and possibly escalate their privilege.
Weakness: CWE-532
Which versions are affected by CVE-2023-1786?
It affects 3 products.
Linux distribution packages (11)
cloud-init AlmaLinux:8 | All versions | 23.1.1-10.el8.alma.1 |
cloud-init AlmaLinux:9 | All versions | 23.1.1-11.el9.alma.1 |
cloud-init Red Hat:enterprise_linux:8::appstream | All versions | 0:23.1.1-10.el8 |
cloud-init Red Hat:enterprise_linux:9::appstream | All versions | 0:23.1.1-11.el9 |
cloud-init SUSE:Linux Enterprise Module for Public Cloud 15 SP1 | All versions | 23.3-150100.8.71.1 |
cloud-init SUSE:Linux Enterprise Module for Public Cloud 15 SP2 | All versions | 23.3-150100.8.71.1 |
cloud-init SUSE:Linux Enterprise Module for Public Cloud 15 SP3 | All versions | 23.3-150100.8.71.1 |
cloud-init SUSE:Linux Enterprise Module for Public Cloud 15 SP4 | All versions | 23.3-150100.8.71.1 |
cloud-init SUSE:Linux Enterprise Module for Public Cloud 15 SP5 | All versions | 23.3-150100.8.71.1 |
cloud-init openSUSE:Leap 15.4 | All versions | 23.3-150100.8.71.1 |
cloud-init openSUSE:Leap 15.5 | All versions | 23.3-150100.8.71.1 |
Products include Canonical Cloud-Init, Canonical Ubuntu Linux, Fedoraproject Fedora.
How do I fix CVE-2023-1786?
Upgrade to a fixed version.
Is CVE-2023-1786 being exploited?
There is no known exploitation of CVE-2023-1786 in the wild and no public exploit code.
Other vulnerabilities in Canonical Ubuntu Linux
Sources
Also known as ALSA-2023:6371, ALSA-2023:6943, AZL-26342, CLEANSTART-2024-JF46935, CLSA-2025-1760025490, DEBIAN-CVE-2023-1786 and 7 more.