Yes, its secure.
Note: The following is way more info then anyone needs but I thought why not.
A while back, around when the internet was created, HTTP, or the Hypertext Transfer Protocol, was created to transfer website data. -- Wait I've seen that before -- Yes you have. In a URL the first section specifies the protocol so when connecting to http://example.com you are using the HTTP protocol. When connecting to ftp://example.com you are using, yes you guessed it, the FTP protocol, or File Transfer Protocol. HTTP is an insecure protocol that send data over plain text. Meaning anyone connected to (or not connected to) the WiFi network can snoop on all passwords, credit cards, addresses, etc. sent over the internet.
More Info: https://en.wikipedia.org/wiki/Hypertext_Transfer_Protocol
iCloud, Google, StackExchange, Yahoo, Chase Bank, Twitter, Spotify, and basically every website (hopefully) that requires you to login or submit information uses an addition to the HTTP protocol called HTTPS, or HTTP + SSL, or secure sockets layer (Yes, us computer people like to shorten things). (In fact, you're using it right now. Look at the URL in on your browser. See the HTTPS?) SSL Encryption is EXTREMELY secure (How Secure?, you ask). This prevents any data from being snooped on by other people. It encrypts all data sent between the client (you) and the server (the server the website is hosted on).
So, since iCloud uses HTTPS all the information is secure even if you are on an insecure network.