When a non-x86 platform is detected, cloud-init grants root access to a hardcoded url with a local IP address. To prevent this, cloud-init default configurations disable platform enumeration.

The remote AlmaLinux 8 host has a package installed that is affected by a vulnerability as referenced in the ALSA-2025:11324 advisory.

    * cloud-init: Cloud init permissions flaw (CVE-2024-6174)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2025-10848 advisory.

    - Resolves: RHEL-100611       (CVE-2024-6174 cloud-init: From CVEorg collector [rhel-9.6.z])

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2025:11337 advisory.

    The cloud-init packages provide a set of init scripts for cloud instances. Cloud instances need special     scripts to run during initialization to retrieve and install SSH keys, and to let the user run various     scripts.

    Security Fix(es):

    * cloud-init: Cloud init permissions flaw (CVE-2024-6174)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2025:11339 advisory.

    The cloud-init packages provide a set of init scripts for cloud instances. Cloud instances need special     scripts to run during initialization to retrieve and install SSH keys, and to let the user run various     scripts.

    Security Fix(es):

    * cloud-init: Cloud init permissions flaw (CVE-2024-6174)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2025:11324 advisory.

    The cloud-init packages provide a set of init scripts for cloud instances. Cloud instances need special     scripts to run during initialization to retrieve and install SSH keys, and to let the user run various     scripts.

    Security Fix(es):

    * cloud-init: Cloud init permissions flaw (CVE-2024-6174)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2025:11295 advisory.

    The cloud-init packages provide a set of init scripts for cloud instances. Cloud instances need special     scripts to run during initialization to retrieve and install SSH keys, and to let the user run various     scripts.

    Security Fix(es):

    * cloud-init: Cloud init permissions flaw (CVE-2024-6174)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of cloud-init installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-6174 advisory.

  - When a non-x86 platform is detected, cloud-init grants root access to a hardcoded url with a local IP     address. To prevent this, cloud-init default configurations disable platform enumeration. (CVE-2024-6174)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2025-10844 advisory.

    [24.4-3.0.1.2]
    - NetworkManagerActivator brings up interface failed when using sysconfig renderer [RHEL-18981]
    - Include module cc_write_files_deferred in config template [Orabug: 36959464]
    - Fix Oracle Datasource network, getdata methods and increase retries [Orabug: 37065979]
    - Fix log file permission [Orabug: 35302969]
    - Update detection logic for OL distros in config template [Orabug: 34845400]
    - Added missing services in rhel/systemd/cloud-init.service [Orabug: 32183938]
    - Added missing services in cloud-init.service.tmpl for sshd [Orabug: 32183938]
    - Forward port applicable cloud-init 18.4-2.0.3 changes to cloud-init-18-5 [Orabug: 30435672]
    - limit permissions [Orabug: 31352433]
    - Changes to ignore all enslaved interfaces [Orabug: 30092148]
    - add modified version of enable-ec2_utils-to-stop-retrying-to-get-ec2-metadata.patch:
      1. Enable ec2_utils.py having a way to stop retrying to get ec2 metadata       2. Apply stop retrying to get ec2 metadata to helper/openstack.py MetadataReader       Resolves: Oracle-Bug:41660 (Bugzilla)
    - added OL to list of known distros

    [24.4-3.2]
    - ci-fix-Don-t-attempt-to-identify-non-x86-OpenStack-inst.patch [RHEL-100617]
    - ci-fix-strict-disable-in-ds-identify-on-no-datasources-.patch [RHEL-100617]
    - Resolves: RHEL-100617       (CVE-2024-6174 cloud-init: From CVEorg collector [rhel-10.1])

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2025:10879 advisory.

    The cloud-init packages provide a set of init scripts for cloud instances. Cloud instances need special     scripts to run during initialization to retrieve and install SSH keys, and to let the user run various     scripts.

    Security Fix(es):

    * cloud-init: Cloud init permissions flaw (CVE-2024-6174)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2025:10876 advisory.

    The cloud-init packages provide a set of init scripts for cloud instances. Cloud instances need special     scripts to run during initialization to retrieve and install SSH keys, and to let the user run various     scripts.

    Security Fix(es):

    * cloud-init: Cloud init permissions flaw (CVE-2024-6174)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2025:10848 advisory.

    The cloud-init packages provide a set of init scripts for cloud instances. Cloud instances need special     scripts to run during initialization to retrieve and install SSH keys, and to let the user run various     scripts.

    Security Fix(es):

    * cloud-init: Cloud init permissions flaw (CVE-2024-6174)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2025:10844 advisory.

    The cloud-init packages provide a set of init scripts for cloud instances. Cloud instances need special     scripts to run during initialization to retrieve and install SSH keys, and to let the user run various     scripts.

    Security Fix(es):

    * cloud-init: Cloud init permissions flaw (CVE-2024-6174)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of cloud-init installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-6174 advisory.

  - When a non-x86 platform is detected, cloud-init grants root access to a hardcoded url with a local IP     address. To prevent this, cloud-init default configurations disable platform enumeration. (CVE-2024-6174)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of cloud-init installed on the remote host is prior to 19.3-46. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2025-2926 advisory.

    When a non-x86 platform is detected, cloud-init grants root access to a hardcoded url with a local IP     address. To prevent this, cloud-init default configurations disable platform enumeration. (CVE-2024-6174)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-1082 advisory.

    When a non-x86 platform is detected, cloud-init grants root access to a hardcoded url with a local IP     address. To prevent this, cloud-init default configurations disable platform enumeration. (CVE-2024-6174)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
242241	AlmaLinux 8 : cloud-init (ALSA-2025:11324)	Nessus	Alma Linux Local Security Checks	high
242237	Oracle Linux 9 : cloud-init (ELSA-2025-10848)	Nessus	Oracle Linux Local Security Checks	high
242210	RHEL 8 : cloud-init (RHSA-2025:11337)	Nessus	Red Hat Local Security Checks	high
242206	RHEL 8 : cloud-init (RHSA-2025:11339)	Nessus	Red Hat Local Security Checks	high
242203	RHEL 8 : cloud-init (RHSA-2025:11324)	Nessus	Red Hat Local Security Checks	high
242191	RHEL 9 : cloud-init (RHSA-2025:11295)	Nessus	Red Hat Local Security Checks	high
242159	Azure Linux 3.0 Security Update: cloud-init (CVE-2024-6174)	Nessus	Azure Linux Local Security Checks	high
242092	Oracle Linux 10 : cloud-init (ELSA-2025-10844)	Nessus	Oracle Linux Local Security Checks	high
242069	RHEL 9 : cloud-init (RHSA-2025:10879)	Nessus	Red Hat Local Security Checks	high
242068	RHEL 9 : cloud-init (RHSA-2025:10876)	Nessus	Red Hat Local Security Checks	high
242061	RHEL 9 : cloud-init (RHSA-2025:10848)	Nessus	Red Hat Local Security Checks	high
242055	RHEL 10 : cloud-init (RHSA-2025:10844)	Nessus	Red Hat Local Security Checks	high
241872	CBL Mariner 2.0 Security Update: cloud-init (CVE-2024-6174)	Nessus	MarinerOS Local Security Checks	high
241765	Amazon Linux 2 : cloud-init (ALAS-2025-2926)	Nessus	Amazon Linux Local Security Checks	high
241757	Amazon Linux 2023 : cloud-init, cloud-init-cfg-ec2, cloud-init-cfg-onprem (ALAS2023-2025-1082)	Nessus	Amazon Linux Local Security Checks	high

Detections

Analytics

CVE-2024-6174

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high