Last Modified: Oct 07, 2026
Affected Product(s):
F5OS F5OS
Known Affected Versions:
F5OS v2.0.0, F5OS v2.0.0-HR1, F5OS v2.0.0-HR2
Opened: Aug 20, 2026 Severity: 3-Major
Passwords available in the chpasswd.list could appear unmasked in the cloud-init processed-data output when the username/password entries used the hyphenated array format.
Passwords could be exposed in the confd state data(using show cloud-inits) and cloud-init API output. The cloud-init password configuration itself continued to work.
The user-data includes chpasswd.list as a YAML sequence, for example: chpasswd: list: - user1:abcd - user2:abcd expire: False
No workaround.
None