CVE-2021-3429
sensitive data exposure in cloud-init logs
When instructing cloud-init to set a random password for a new user account, versions before 21.2 would write that password to the world-readable log file /var/log/cloud-init-output.log. This could allow a local user to log in as another user.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
sensitive data exposure in cloud-init logs
When instructing cloud-init to set a random password for a new user account, versions before 21.2 would write that password to the world-readable log file /var/log/cloud-init-output.log. This could allow a local user to log in as another user.
- Record
CVE-2021-3429- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-532, CWE-532
- Updated
- 2026-11-02
EUVDEUVD-2021-26755
When instructing cloud-init to set a random password for a new user account, versions before 21.2 would write that password to the world-readable log file /var/log/cloud-init-output.log. This could allow a local user to log in as another user.
- Record
EUVD-2021-26755- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-jj89-4799-j2qv
When instructing cloud-init to set a random password for a new user account, versions before 21.2...
When instructing cloud-init to set a random password for a new user account, versions before 21.2 would write that password to the world-readable log file /var/log/cloud-init-output.log. This could allow a local user to log in as another user.
- Record
GHSA-jj89-4799-j2qv- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-532
- Updated
- 2026-11-02
NVD
When instructing cloud-init to set a random password for a new user account, versions before 21.2 would write that password to the world-readable log file /var/log/cloud-init-output.log. This could allow a local user to log in as another user.
- Record
CVE-2021-3429- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-532
- Updated
- 2026-11-02
OSVALPINE-CVE-2021-3429
When instructing cloud-init to set a random password for a new user account, versions before 21.2 would write that password to the world-readable log file /var/log/cloud-init-output.log. This could allow a local user to log in as another user.
- Record
ALPINE-CVE-2021-3429- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-03
OSVBELL-CVE-2021-3429
CVE-2021-3429 does not affect BellSoft software
- Record
BELL-CVE-2021-3429- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
Show 12 moreShow less
OSV
When instructing cloud-init to set a random password for a new user account, versions before 21.2 would write that password to the world-readable log file /var/log/cloud-init-output.log. This could allow a local user to log in as another user.
- Record
CVE-2021-3429- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2021-3429
When instructing cloud-init to set a random password for a new user account, versions before 21.2 would write that password to the world-readable log file /var/log/cloud-init-output.log. This could allow a local user to log in as another user.
- Record
DEBIAN-CVE-2021-3429- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVOESA-2021-1372
cloud-init security update
Cloud-init is the defacto multi-distribution package that handles early initialization of a cloud instance.
Security Fix(es):
(CVE-2021-3429)
- Record
OESA-2021-1372- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVRHSA-2021:3081
Red Hat Security Advisory: cloud-init security update
- Record
RHSA-2021:3081- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVRHSA-2021:3177
Red Hat Security Advisory: cloud-init security update
- Record
RHSA-2021:3177- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVRHSA-2021:3371
Red Hat Security Advisory: cloud-init security update
- Record
RHSA-2021:3371- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVRLSA-2021:3081
Moderate: cloud-init security update
The cloud-init packages provide a set of init scripts for cloud instances. Cloud instances need special scripts to run during initialization to retrieve and install SSH keys, and to let the user run various scripts.
Security Fix(es):
- cloud-init: randomly generated passwords logged in clear-text to world-readable file (CVE-2021-3429)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
RLSA-2021:3081- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2021-3429
When instructing cloud-init to set a random password for a new user account, versions before 21.2 would write that password to the world-readable log file /var/log/cloud-init-output.log. This could allow a local user to log in as another user.
- Record
UBUNTU-CVE-2021-3429- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVMGASA-2021-0494 No score
Updated cloud-init packages fix security vulnerability
cloud-init has the ability to generate and set a randomized password for system users. This functionality is enabled at runtime by passing cloud-config data such as: 'chpasswd: list: | user1:RANDOM'
When instructing cloud-init to set a random password for a new user account, versions before 21.1.19 would write that password to the world-readable log file /var/log/cloud-init-output.log. This could allow a local user to log in as another user (CVE-2021-3429).
- Record
MGASA-2021-0494- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:13053-1 No score
cloud-init-23.1-2.1 on GA media
These are all security issues fixed in the cloud-init-23.1-2.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:13053-1- Updated
- 2026-11-02
OSVSUSE-FU-2023:3283-1 No score
Feature update for cloud-init
This update for cloud-init fixes the following issues:
- Default route is not configured (bsc#1212879)
- cloud-final service failing in powerVS (bsc#1210273)
- Randomly generated passwords logged in clear-text to world-readable file (bsc#1184758, CVE-2021-3429)
- Record
SUSE-FU-2023:3283-1- Updated
- 2026-11-02
OSVSUSE-SU-2023:2164-1 No score
Security update for cloud-init
This update for cloud-init contains following fixes:
- CVE-2021-3429: Do not write the generated password to the log file. (bsc#1184758)
- CVE-2023-1786: Do not expose sensitive data gathered from the CSP. (bsc#1210277)
Other fixes:
- Change log file creation mode to 640. (bsc#1183939)
- Write proper bonding option configuration for SLE/openSUSE. (bsc#1184085)
- Do not including sudoers.d directory twice. (bsc#1181283)
- Record
SUSE-SU-2023:2164-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
cloud-initAlpine:v3.13 |
before 20.4.1-r1 | 20.4.1-r1 |
cloud-initAlpine:v3.14 |
before 21.1-r1 | 21.1-r1 |
cloud-initAlpine:v3.15 |
before 21.1-r1 | 21.1-r1 |
cloud-initAlpine:v3.16 |
before 21.1-r1 | 21.1-r1 |
cloud-initAlpine:v3.17 |
before 21.1-r1 | 21.1-r1 |
cloud-initAlpine:v3.18 |
before 21.1-r1 | 21.1-r1 |
cloud-initAlpine:v3.19 |
before 21.1-r1 | 21.1-r1 |
cloud-initAlpine:v3.20 |
before 21.1-r1 | 21.1-r1 |
cloud-initAlpine:v3.21 |
before 21.1-r1 | 21.1-r1 |
cloud-initAlpine:v3.22 |
before 21.1-r1 | 21.1-r1 |
Show 25 moreShow less
| Package | Affected | Fixed |
|---|---|---|
cloud-initAlpine:v3.23 |
before 21.1-r1 | 21.1-r1 |
cloud-initAlpine:v3.24 |
before 21.1-r1 | 21.1-r1 |
cloud-initDebian:12 |
before 20.4.1-2 | 20.4.1-2 |
cloud-initDebian:13 |
before 20.4.1-2 | 20.4.1-2 |
cloud-initDebian:14 |
before 20.4.1-2 | 20.4.1-2 |
cloud-initDebian:9 |
before 0.7.9-2+deb9u1, plus listed versions 0.7.9-2 |
0.7.9-2+deb9u1 |
cloud-initMageia:8 |
before 20.2-2.1.mga8 | 20.2-2.1.mga8 |
cloud-initopenEuler:20.03-LTS-SP1 |
before 19.4-5.oe1 | 19.4-5.oe1 |
cloud-initopenEuler:20.03-LTS-SP2 |
before 19.4-5.oe1 | 19.4-5.oe1 |
cloud-initRed Hat:enterprise_linux:8::appstream |
before 0:20.3-10.el8_4.5 | 0:20.3-10.el8_4.5 |
cloud-initRed Hat:rhel_eus:8.1::appstream |
before 0:18.5-7.el8_1.6 | 0:18.5-7.el8_1.6 |
cloud-initRed Hat:rhel_eus:8.2::appstream |
before 0:18.5-12.el8_2.10 | 0:18.5-12.el8_2.10 |
cloud-initRocky Linux:8 |
before 0:20.3-10.el8_4.5 | 0:20.3-10.el8_4.5 |
cloud-initSUSE:Linux Enterprise Module for Public Cloud 15 SP1 From an advisory covering 2 CVEs |
before 23.1-150100.8.66.1 | 23.1-150100.8.66.1 |
cloud-initSUSE:Linux Enterprise Module for Public Cloud 15 SP2 From an advisory covering 2 CVEs |
before 23.1-150100.8.66.1 | 23.1-150100.8.66.1 |
cloud-initSUSE:Linux Enterprise Module for Public Cloud 15 SP3 From an advisory covering 2 CVEs |
before 23.1-150100.8.66.1 | 23.1-150100.8.66.1 |
cloud-initSUSE:Linux Enterprise Module for Public Cloud 15 SP4 From an advisory covering 2 CVEs |
before 23.1-150100.8.66.1 | 23.1-150100.8.66.1 |
cloud-initSUSE:Linux Enterprise Module for Public Cloud 15 SP5 From an advisory covering 2 CVEs |
before 23.1-150100.8.66.1 | 23.1-150100.8.66.1 |
cloud-initopenSUSE:Leap 15.4 From an advisory covering 2 CVEs |
before 23.1-150100.8.66.1 | 23.1-150100.8.66.1 |
cloud-initopenSUSE:Leap 15.5 From an advisory covering 2 CVEs |
before 23.1-150100.8.66.1 | 23.1-150100.8.66.1 |
cloud-initSUSE:Linux Enterprise Module for Public Cloud 12 From an advisory covering 2 CVEs |
before 20.2-37.57.1 | 20.2-37.57.1 |
cloud-initUbuntu:16.04:LTS |
before 21.1-19-gbad84ad4-0ubuntu1~16.04.1, plus listed versions 0.7.7~bzr1149-0ubuntu10.7.7~bzr1154-0ubuntu10.7.7~bzr1155-0ubuntu10.7.7~bzr1156-0ubuntu10.7.7~bzr1156-0ubuntu2 Show 45 moreShow less0.7.7~bzr1160-0ubuntu10.7.7~bzr1176-0ubuntu10.7.7~bzr1182-0ubuntu10.7.7~bzr1189-0ubuntu10.7.7~bzr1192-0ubuntu10.7.7~bzr1192-0ubuntu20.7.7~bzr1200-0ubuntu10.7.7~bzr1208-0ubuntu10.7.7~bzr1209-0ubuntu10.7.7~bzr1212-0ubuntu10.7.7~bzr1246-0ubuntu1~16.04.10.7.7~bzr1256-0ubuntu1~16.04.10.7.8-1-g3705bb5-0ubuntu1~16.04.10.7.8-1-g3705bb5-0ubuntu1~16.04.30.7.8-49-g9e904bb-0ubuntu1~16.04.10.7.8-49-g9e904bb-0ubuntu1~16.04.20.7.8-49-g9e904bb-0ubuntu1~16.04.30.7.8-49-g9e904bb-0ubuntu1~16.04.40.7.9-0ubuntu1~16.04.20.7.9-48-g1c795b9-0ubuntu1~16.04.10.7.9-90-g61eb03fe-0ubuntu1~16.04.10.7.9-113-g513e99e0-0ubuntu1~16.04.10.7.9-153-g16a7302f-0ubuntu1~16.04.10.7.9-153-g16a7302f-0ubuntu1~16.04.20.7.9-233-ge586fe35-0ubuntu1~16.04.10.7.9-233-ge586fe35-0ubuntu1~16.04.217.1-27-geb292c18-0ubuntu1~16.04.117.1-46-g7acc9e68-0ubuntu1~16.04.117.2-35-gf576b2a2-0ubuntu1~16.04.218.2-4-g05926e48-0ubuntu1~16.04.118.2-4-g05926e48-0ubuntu1~16.04.218.3-9-g2e62cb8a-0ubuntu1~16.04.218.4-0ubuntu1~16.04.218.5-21-g8ee294d5-0ubuntu1~16.04.118.5-45-g3554ffe8-0ubuntu1~16.04.119.1-1-gbaa47854-0ubuntu1~16.04.119.2-24-ge7881d5c-0ubuntu1~16.04.119.2-36-g059d049c-0ubuntu1~16.04.119.2-36-g059d049c-0ubuntu2~16.04.119.3-41-gc4735dd3-0ubuntu1~16.04.119.4-33-gbb4131a2-0ubuntu1~16.04.120.2-45-g5f7825e2-0ubuntu1~16.04.120.3-2-g371b392c-0ubuntu1~16.04.120.4-0ubuntu1~16.04.120.4-0ubuntu1~16.04.2 |
21.1-19-gbad84ad4-0ubuntu1~16.04.1 |
cloud-initUbuntu:18.04:LTS |
before 21.1-19-gbad84ad4-0ubuntu1~18.04.1, plus listed versions 17.1-18-gd4f70470-0ubuntu117.1-25-g17a15f9e-0ubuntu1~17.10.117.1-25-g17a15f9e-0ubuntu117.1-27-geb292c18-0ubuntu117.1-41-g76243487-0ubuntu1 Show 40 moreShow less17.1-46-g7acc9e68-0ubuntu117.1-51-g05b2308a-0ubuntu117.1-53-ga5dc0f42-0ubuntu117.1-58-g703241a3-0ubuntu117.1-60-ga30a3bb5-0ubuntu117.2-1-g4089e20c-0ubuntu117.2-9-gdf24daa8-0ubuntu117.2-13-g6299e8d0-0ubuntu117.2-20-g32a6a176-0ubuntu117.2-25-gc03bdd3d-0ubuntu117.2-30-gf7deaf15-0ubuntu117.2-34-g644048e3-0ubuntu118.1-0ubuntu118.1-5-g40e77380-0ubuntu118.1-17-g97012fbb-0ubuntu118.1-23-gde34dc7c-0ubuntu118.1-26-g685f9901-0ubuntu118.1-35-ge0f644b7-0ubuntu118.1-35-ge0f644b7-0ubuntu218.2-0ubuntu118.2-4-g05926e48-0ubuntu118.2-4-g05926e48-0ubuntu218.2-9-g49b562c9-0ubuntu118.2-14-g6d48d265-0ubuntu118.2-27-g6ef92c98-0ubuntu1~18.04.118.3-9-g2e62cb8a-0ubuntu1~18.04.218.4-0ubuntu1~18.04.118.5-21-g8ee294d5-0ubuntu1~18.04.118.5-45-g3554ffe8-0ubuntu1~18.04.119.1-1-gbaa47854-0ubuntu1~18.04.119.2-24-ge7881d5c-0ubuntu1~18.04.119.2-36-g059d049c-0ubuntu1~18.04.119.2-36-g059d049c-0ubuntu2~18.04.119.3-41-gc4735dd3-0ubuntu1~18.04.119.4-33-gbb4131a2-0ubuntu1~18.04.120.2-45-g5f7825e2-0ubuntu1~18.04.120.3-2-g371b392c-0ubuntu1~18.04.120.4-0ubuntu1~18.04.120.4-0ubuntu1~18.04.220.4.1-0ubuntu1~18.04.1 |
21.1-19-gbad84ad4-0ubuntu1~18.04.1 |
cloud-initUbuntu:20.04:LTS |
before 21.1-19-gbad84ad4-0ubuntu1~20.04.1, plus listed versions 19.2-36-g059d049c-0ubuntu319.2-78-ge8138959-0ubuntu119.3-0ubuntu119.3-23-gfb04493e-0ubuntu119.3-30-g4bc399e0-0ubuntu1 Show 20 moreShow less19.3-40-gf69d33a7-0ubuntu119.3-41-gc4735dd3-0ubuntu119.3-74-g129b1c4e-0ubuntu119.4-1-g8c96cbc1-0ubuntu119.4-16-gf8950d63-0ubuntu119.4-31-g3f6192b3-0ubuntu119.4-33-gbb4131a2-0ubuntu119.4-56-g06e324ff-0ubuntu120.1-0ubuntu120.1-5-g67c8e53c-0ubuntu120.1-9-g1f860e5a-0ubuntu120.1-10-g71af48df-0ubuntu120.1-10-g71af48df-0ubuntu220.1-10-g71af48df-0ubuntu320.1-10-g71af48df-0ubuntu520.2-45-g5f7825e2-0ubuntu1~20.04.120.3-2-g371b392c-0ubuntu1~20.04.120.4-0ubuntu1~20.04.120.4-0ubuntu1~20.04.220.4.1-0ubuntu1~20.04.1 |
21.1-19-gbad84ad4-0ubuntu1~20.04.1 |
cloud-initopenSUSE:Tumbleweed From an advisory covering 2 CVEs |
before 23.1-2.1 | 23.1-2.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| affected, aliases, references | OSV | |
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-3429 is a medium vulnerability (CVSS 5.5) in Canonical Cloud-init, published March 20, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.22%, the 12th percentile. Fixed in cloud-init 20.4.1-r1.
References
github.com/canonical/cloud-init/commit/b794d426b9ab43ea9d6371477466070d86e10668
nvd.nist.gov/vuln/detail/CVE-2021-3429
security.alpinelinux.org/vuln/CVE-2021-3429
docs.bell-sw.com/security/cves/CVE-2021-3429
security-tracker.debian.org/tracker/CVE-2021-3429
Show 28 moreShow less
advisories.mageia.org/MGASA-2021-0494.html
bugs.mageia.org/show_bug.cgi?id=28991
debian.org/lts/security/2021/dla-2601
openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2021-1372
access.redhat.com/errata/RHSA-2021:3081
bugzilla.redhat.com/show_bug.cgi?id=1940967
security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_3081.json
cve.org/CVERecord?id=CVE-2021-3429
errata.rockylinux.org/RLSA-2021:3081
suse.com/support/update/announcement/-2023-3283/suse-fu-20233283-1
bugzilla.suse.com/1184758
ubuntu.com/security/CVE-2021-3429
Left out here: 1 version. The JSON record has them.