Read the docs
TI-2026-09826 Aliases CVE-2026-11386GHSA-9836-vm3x-qwmj

ubuntu-pro-client Input Validation Vulnerability Leading to Arbitrary APT Directive Injection and Remote Code Execution

Priority MEDIUM 41CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

An input validation and injection vulnerability exists in Canonical ubuntu-pro-client (formerly ubuntu-advantage-tools). The client constructs APT source files (such as /etc/apt/sources.list.d/ubuntu-.list or their DEB822 equivalents) using data received directly from the contract server response via the directives.suites[] and directives.aptURL fields. Because the client utilizes Python's str.format() to write these files without performing escaping, validation, or newline character filtering, a malicious or tampered contract response containing embedded newline (\n) characters can successfully inject arbitrary, attacker-controlled deb configuration lines into root-owned APT sources. When combined with the unvalidated additionalPackages[] field—which is passed positionally into a root-executed apt-get install command—an attacker capable of spoofing or manipulating the contract response (e.g., via a compromised internal infrastructure, an intercepted connection utilizing a trusted CA, or local logical bugs) can force the client to fetch and install malicious packages. This ultimately leads to arbitrary code execution with root privileges on the affected system. This component is preinstalled on supported Ubuntu Server releases and auto-attaches by default on cloud provider Ubuntu Pro images.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00526 44th percentileScored 2026-11-07
Fix Fixed ubuntu-pro-client (ubuntu-advantage-tools) (Canonical): 37.3Ubuntu 26.04 LTS (Canonical): 37.2ubuntu0.1+6 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Canonicalubuntu-pro-client (ubuntu-advantage-tools)before 37.337.3Patch availableCNA
CanonicalUbuntu 26.04 LTS—37.2ubuntu0.1Patch availableCNA
CanonicalUbuntu 24.04 LTS—37.2ubuntu~24.04.1Patch availableCNA
CanonicalUbuntu 22.04 LTS—37.2ubuntu~22.04.1Patch availableCNA
CanonicalUbuntu 20.04 LTS—37.1ubuntu0~20.04.1Patch availableCNA
CanonicalUbuntu 18.04 LTS—37.1ubuntu0~18.04.1Patch availableCNA
CanonicalUbuntu 16.04 LTS—37.1ubuntu0~16.04.1Patch availableCNA
CanonicalUbuntu 14.04 LTS—19.7ubuntu0.1Patch availableCNA
  • ubuntu-pro-client (ubuntu-advantage-tools) VendorCanonical Affected before 37.3 Fixed in 37.3 Patch available CNA
  • Ubuntu 26.04 LTS VendorCanonical Affected — Fixed in 37.2ubuntu0.1 Patch available CNA
  • Ubuntu 24.04 LTS VendorCanonical Affected — Fixed in 37.2ubuntu~24.04.1 Patch available CNA
  • Ubuntu 22.04 LTS VendorCanonical Affected — Fixed in 37.2ubuntu~22.04.1 Patch available CNA
  • Ubuntu 20.04 LTS VendorCanonical Affected — Fixed in 37.1ubuntu0~20.04.1 Patch available CNA
  • Ubuntu 18.04 LTS VendorCanonical Affected — Fixed in 37.1ubuntu0~18.04.1 Patch available CNA
  • Ubuntu 16.04 LTS VendorCanonical Affected — Fixed in 37.1ubuntu0~16.04.1 Patch available CNA
  • Ubuntu 14.04 LTS VendorCanonical Affected — Fixed in 19.7ubuntu0.1 Patch available CNA

Remediation

  • Fix · CNA ubuntu-pro-client (ubuntu-advantage-tools) (Canonical) Fixed in 37.3
  • Fix · CNA Ubuntu 26.04 LTS (Canonical) Fixed in 37.2ubuntu0.1
  • Fix · CNA Ubuntu 24.04 LTS (Canonical) Fixed in 37.2ubuntu~24.04.1
  • Fix · CNA Ubuntu 22.04 LTS (Canonical) Fixed in 37.2ubuntu~22.04.1
  • Fix · CNA Ubuntu 20.04 LTS (Canonical) Fixed in 37.1ubuntu0~20.04.1
  • Fix · CNA Ubuntu 18.04 LTS (Canonical) Fixed in 37.1ubuntu0~18.04.1
  • Fix · CNA Ubuntu 16.04 LTS (Canonical) Fixed in 37.1ubuntu0~16.04.1
  • Fix · CNA Ubuntu 14.04 LTS (Canonical) Fixed in 19.7ubuntu0.1

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Canonical ubuntu-pro-client (ubuntu-advantage-tools) 37.3

    3 records Highest priority Priority MEDIUM 1 MEDIUM, 2 LOW

    Other records, highest priority first

    • TI-2026-08340 ubuntu-pro-client Information Disclosure via Cleartext Bearer Token Exposure in Process Command LinePriority LOW 24
    • TI-2026-10639 ubuntu-pro-client Local Privilege Escalation and Information Disclosure via Symlink Arbitrary File Read in collect-logsPriority LOW 22
    Show all 3 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-11386
  2. 2026-10-03 Alias added: GHSA-9836-vm3x-qwmj

References

Other 1

  • TI-2020-09349 An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. KEVCVSS 3.1CRITICAL 9.8
  • TI-2020-05854 smtp_mailaddr in smtp_session.c in OpenSMTPD 6.6, as used in OpenBSD 6.6 and other… KEVCVSS 3.1CRITICAL 9.8
  • TI-2020-01431 Netlogon Elevation of Privilege Vulnerability KEVCVSS 3.1CRITICAL 10.0
  • TI-2019-12627 Exim 4.92 through 4.92.2 allows remote code execution, a different vulnerability than… KEVCVSS 3.1CRITICAL 9.8
  • TI-2019-08259 Underflow in PHP-FPM can lead to RCE KEVCVSS 3.1CRITICAL 9.8
  • TI-2019-07471 OS command injection in exim KEVCVSS 3.1CRITICAL 9.8
See all 4301 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences