https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-14T22:02:35.255502+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2024-11584 CVE-2024-11584 2026-10-14T22:02:35.257700+00:00

Affected: Canonical cloud-init

cloud-init through 25.1.2 includes the systemd socket unit cloud-init-hotplugd.socket with default SocketMode that grants 0666 permissions, making it world-writable. This is used for the "/run/cloud-init/hook-hotplug-cmd" FIFO. An unprivileged user could trigger hotplug-hook commands.

 https://cve.radiocsirt.org/vuln/usn-7677-1 USN-7677-1 — cloud-init vulnerabilities 2026-10-14T22:02:35.257756+00:00

Affected: Ubuntu:Pro:16.04:LTS: cloud-init, Ubuntu:Pro:18.04:LTS: cloud-init, Ubuntu:Pro:20.04:LTS: cloud-init, Ubuntu:22.04:LTS: cloud-init, Ubuntu:24.04:LTS: cloud-init

Harry Sintonen discovered that the hotplugd socket in cloud-init was world writable. An attacker could possibly use this issue to send hotplug-hook commands. (CVE-2024-11584)

It was discovered that cloud-init granted root access to a hardcoded URL with a local IP address when a non-x86 platform is detected. An attacker could possibly impersonate an OpenStack endpoint and provide root configuration data. (CVE-2024-6174)