Read the docs
TI-2026-08340 Aliases CVE-2026-9494GHSA-4m5m-x42p-vrwg

ubuntu-pro-client Information Disclosure via Cleartext Bearer Token Exposure in Process Command Line

Priority LOW 24CWE-214Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

An information disclosure vulnerability exists in Canonical ubuntu-pro-client (formerly ubuntu-advantage-tools). The client validates Ubuntu Pro APT credentials by executing /usr/lib/apt/apt-helper using the download-file command. During this process, the secret bearer token is embedded directly in the cleartext URL component passed via the command-line arguments (argv), resulting in a URL format such as https://bearer:<token>@esm.ubuntu.com/.../. On systems utilizing a default-mounted /proc file system where process-hiding mitigations (such as hidepid) are disabled, an unprivileged local attacker can monitor system processes and read the sensitive bearer token directly from /proc/cmdline while the helper process is actively running. This leaked token can subsequently be used to gain unauthorized access to the victim's Ubuntu Pro or Expanded Security Maintenance (ESM) repositories.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00146 3rd percentileScored 2026-11-07
Fix Fixed ubuntu-pro-client (ubuntu-advantage-tools) (Canonical): 37.3Ubuntu 26.04 LTS (Canonical): 37.2ubuntu0.1+6 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Canonicalubuntu-pro-client (ubuntu-advantage-tools)before 37.337.3Patch availableCNA
CanonicalUbuntu 26.04 LTS—37.2ubuntu0.1Patch availableCNA
CanonicalUbuntu 24.04 LTS—37.2ubuntu~24.04.1Patch availableCNA
CanonicalUbuntu 22.04 LTS—37.2ubuntu~22.04.1Patch availableCNA
CanonicalUbuntu 20.04 LTS—37.1ubuntu0~20.04.1Patch availableCNA
CanonicalUbuntu 18.04 LTS—37.1ubuntu0~18.04.1Patch availableCNA
CanonicalUbuntu 16.04 LTS—37.1ubuntu0~16.04.1Patch availableCNA
CanonicalUbuntu 14.04 LTS—19.7ubuntu0.1Patch availableCNA
  • ubuntu-pro-client (ubuntu-advantage-tools) VendorCanonical Affected before 37.3 Fixed in 37.3 Patch available CNA
  • Ubuntu 26.04 LTS VendorCanonical Affected — Fixed in 37.2ubuntu0.1 Patch available CNA
  • Ubuntu 24.04 LTS VendorCanonical Affected — Fixed in 37.2ubuntu~24.04.1 Patch available CNA
  • Ubuntu 22.04 LTS VendorCanonical Affected — Fixed in 37.2ubuntu~22.04.1 Patch available CNA
  • Ubuntu 20.04 LTS VendorCanonical Affected — Fixed in 37.1ubuntu0~20.04.1 Patch available CNA
  • Ubuntu 18.04 LTS VendorCanonical Affected — Fixed in 37.1ubuntu0~18.04.1 Patch available CNA
  • Ubuntu 16.04 LTS VendorCanonical Affected — Fixed in 37.1ubuntu0~16.04.1 Patch available CNA
  • Ubuntu 14.04 LTS VendorCanonical Affected — Fixed in 19.7ubuntu0.1 Patch available CNA

Remediation

  • Fix · CNA ubuntu-pro-client (ubuntu-advantage-tools) (Canonical) Fixed in 37.3
  • Fix · CNA Ubuntu 26.04 LTS (Canonical) Fixed in 37.2ubuntu0.1
  • Fix · CNA Ubuntu 24.04 LTS (Canonical) Fixed in 37.2ubuntu~24.04.1
  • Fix · CNA Ubuntu 22.04 LTS (Canonical) Fixed in 37.2ubuntu~22.04.1
  • Fix · CNA Ubuntu 20.04 LTS (Canonical) Fixed in 37.1ubuntu0~20.04.1
  • Fix · CNA Ubuntu 18.04 LTS (Canonical) Fixed in 37.1ubuntu0~18.04.1
  • Fix · CNA Ubuntu 16.04 LTS (Canonical) Fixed in 37.1ubuntu0~16.04.1
  • Fix · CNA Ubuntu 14.04 LTS (Canonical) Fixed in 19.7ubuntu0.1

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Canonical ubuntu-pro-client (ubuntu-advantage-tools) 37.3

    3 records Highest priority Priority MEDIUM 1 MEDIUM, 2 LOW

    Other records, highest priority first

    • TI-2026-09826 ubuntu-pro-client Input Validation Vulnerability Leading to Arbitrary APT Directive Injection and Remote Code ExecutionPriority MEDIUM 41
    • TI-2026-10639 ubuntu-pro-client Local Privilege Escalation and Information Disclosure via Symlink Arbitrary File Read in collect-logsPriority LOW 22
    Show all 3 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-9494
  2. 2026-10-03 Alias added: GHSA-4m5m-x42p-vrwg

References

Other 1

  • TI-2020-09349 An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. KEVCVSS 3.1CRITICAL 9.8
  • TI-2020-05854 smtp_mailaddr in smtp_session.c in OpenSMTPD 6.6, as used in OpenBSD 6.6 and other… KEVCVSS 3.1CRITICAL 9.8
  • TI-2020-01431 Netlogon Elevation of Privilege Vulnerability KEVCVSS 3.1CRITICAL 10.0
  • TI-2019-12627 Exim 4.92 through 4.92.2 allows remote code execution, a different vulnerability than… KEVCVSS 3.1CRITICAL 9.8
  • TI-2019-08259 Underflow in PHP-FPM can lead to RCE KEVCVSS 3.1CRITICAL 9.8
  • TI-2019-07471 OS command injection in exim KEVCVSS 3.1CRITICAL 9.8
See all 4301 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences