CVE-2018-10896 describes a misconfiguration in cloud-init versions 0.6.2 and newer, where the default setting "ssh_deletekeys: 0" prevents the deletion of SSH host keys. This vulnerability primarily affects Canonical cloud-init and can lead to instances cloned from a master image sharing identical SSH host keys. The severity is rated High (CVSS 7.1), with a local attack vector and low complexity, potentially enabling impersonation or man-in-the-middle attacks between affected systems. There is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 0.6.2, < 18.4CPE matchmatch criteria | cpe:2.3:a:canonical:cloud-init:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.0
CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.2 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
CVE-2018-10896
Aug 11, 2020The default cloud-init configuration in cloud-init 0.6.2 and newer included "ssh_deletekeys: 0" disabling cloud-init's deletion of ssh host keys. In some environments this could lead to instances created by cloning a golden master or template system sharing ssh host keys and being able to impersonate one another or conduct man-in-the-middle attacks.
Aug 14, 2018cloud-init: default configuration disabled deletion of SSH host keys
Jul 6, 2018