CVE-2024-6174 Hardcoded credentials in cloud-init

High 8.8 Published 26 Jun 2025 Updated 26 Jun 2025

Attackers can gain root access on non-x86 platforms via a hardcoded URL if platform enumeration is enabled, requiring configuration changes to mitigate.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: Not needed
Fix: Available

What is CVE-2024-6174?

CVE-2024-6174 is a high-severity vulnerability in Canonical cloud-init, published on 26 Jun 2025. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

When a non-x86 platform is detected, cloud-init grants root access to a hardcoded url with a local IP address. To prevent this, cloud-init default configurations disable platform enumeration.

Weakness: CWE-287

Which versions are affected by CVE-2024-6174?

It affects 1 product.

Linux distribution packages (15)

`cloud-init` AlmaLinux:10	All versions	`24.4-3.el10_0.2`
`cloud-init` AlmaLinux:8	All versions	`23.4-7.el8_10.10.alma.1`
`cloud-init` AlmaLinux:9	All versions	`24.4-4.el9_6.3.alma.1`
`cloud-init` Red Hat:enterprise_linux:10.0	All versions	`0:24.4-3.el10_0.2`
`cloud-init` Red Hat:enterprise_linux:8::appstream	All versions	`0:23.4-7.el8_10.10`
`cloud-init` Red Hat:enterprise_linux:9::appstream	All versions	`0:24.4-4.el9_6.3`
`cloud-init` Red Hat:rhel_aus:8.6::appstream	All versions	`0:21.1-15.el8_6.4`
`cloud-init` Red Hat:rhel_e4s:8.6::appstream	All versions	`0:21.1-15.el8_6.4`
`cloud-init` Red Hat:rhel_e4s:8.8::appstream	All versions	`0:22.1-8.el8_8.2`
`cloud-init` Red Hat:rhel_e4s:9.0::appstream	All versions	`0:21.1-19.el9_0.7`
`cloud-init` Red Hat:rhel_e4s:9.2::appstream	All versions	`0:22.1-10.el9_2.1`
`cloud-init` Red Hat:rhel_eus:9.4::appstream	All versions	`0:23.4-7.el9_4.13`
`cloud-init` Red Hat:rhel_tus:8.6::appstream	All versions	`0:21.1-15.el8_6.4`
`cloud-init` Red Hat:rhel_tus:8.8::appstream	All versions	`0:22.1-8.el8_8.2`
`cloud-init` Rocky Linux:8	All versions	`0:23.4-7.el8_10.10.0.2`

Products include Canonical Cloud-Init.

How do I fix CVE-2024-6174?

Change a configuration setting.

Is CVE-2024-6174 being exploited?

There is no known exploitation of CVE-2024-6174 in the wild and no public exploit code.

Sources

Also known as ALSA-2025:10844, ALSA-2025:10848, ALSA-2025:11324, AZL-64334, AZL-64374, BELL-CVE-2024-6174 and 13 more.