# CVE-2019-0816: Azure SSH Keypairs Security Feature Bypass Vulnerability

CVE-2019-0816 is fixed in 2 products on 2 platforms, first by KB4491476, released March 12, 2019. It is not reported as exploited. Patch Radar priority: Routine.

- Web page: https://patchblox.com/security/cve/CVE-2019-0816
- Priority: Routine
- CVSS: 5.4 (Moderate)
- EPSS: 0.0140
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Vendor exploitability assessment: Exploitation Less Likely
- Published: Mar 12, 2019
- Vendor advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2019-0816

## Description

<p>A security feature bypass exists in Azure SSH Keypairs, due to a change in the provisioning logic for some Linux images that use cloud-init.  Extraneous Microsoft service public keys can be unexpectedly added to the VM authorized keys file in the limited scenarios described in <a href="https://support.microsoft.com/en-us/help/4491476/extraneous-ssh-public-keys-added-to-authorized-keys-file-on-linux-vm">4491476</a>. For more information on how to know if you are affected and how to protect yourself, please see <a href="https://support.microsoft.com/en-us/help/4491476/extraneous-ssh-public-keys-added-to-authorized-keys-file-on-linux-vm">4491476</a>.</p> <p>This update addresses this vulnerability by preventing these keys from being added.</p>

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Microsoft | UbuntuServer:18.04-LTS |  | [KB4491476](https://patchblox.com/security/data/fix/microsoft/kb4491476.md) | Mar 12, 2019 |
| Linux | cloud-init RHEL 8 | 0:18.5-1.el8.4 | [RHBA-2019:1992](https://patchblox.com/security/data/fix/linux/rhba-2019-1992.md) | Jul 30, 2019 |
| Linux | cloud-init Ubuntu 18.04.6 LTS (bionic) | 18.5-45-g3554ffe8-0ubuntu1~18.04.1 | [cloud-init 18.5-45-g3554ffe8-0ubuntu1~18.04.1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-cloud-init-18.5-45-g3554ffe8-0ubuntu1-18.04.1.md) | Apr 8, 2019 |

---

Data as of 2026-11-07T18:46:35Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.