Read the docs
TI-2026-10639 Aliases CVE-2026-12391GHSA-whf7-7mxf-ww93

ubuntu-pro-client Local Privilege Escalation and Information Disclosure via Symlink Arbitrary File Read in collect-logs

Priority LOW 22CWE-59Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
Required
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-59 and the CVSS impact.

Summary

An insecure symlink following vulnerability exists in Canonical ubuntu-pro-client (formerly ubuntu-advantage-tools) within the pro collect-logs command framework. The utility creates or utilizes predictable temporary file paths or user-accessible log directories when gathering diagnostic information without verifying the file type or ownership. An unprivileged local attacker can exploit this behavior by creating a symbolic link (symlink) at a predictable destination path pointing to an arbitrary, root-readable file (such as /etc/shadow or private files within /root). When a root administrator or operator subsequently executes the pro collect-logs command, the tool follows the user-controlled symlink, reads the target file, and compresses its contents into the resulting diagnostic support archive. Because the output archive remains readable by the unprivileged user, the attacker can extract and read the sensitive root-owned files, leading to a complete information disclosure of system secrets.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00206 10th percentileScored 2026-11-07
Fix Fixed ubuntu-pro-client (ubuntu-advantage-tools) (Canonical): 37.3Ubuntu 26.04 LTS (Canonical): 37.2ubuntu0.1+5 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Canonicalubuntu-pro-client (ubuntu-advantage-tools)before 37.337.3Patch availableCNA
CanonicalUbuntu 26.04 LTS—37.2ubuntu0.1Patch availableCNA
CanonicalUbuntu 24.04 LTS—37.2ubuntu~24.04.1Patch availableCNA
CanonicalUbuntu 22.04 LTS—37.2ubuntu~22.04.1Patch availableCNA
CanonicalUbuntu 20.04 LTS—37.1ubuntu0~20.04.1Patch availableCNA
CanonicalUbuntu 18.04 LTS—37.1ubuntu0~18.04.1Patch availableCNA
CanonicalUbuntu 16.04 LTS—37.1ubuntu0~16.04.1Patch availableCNA
  • ubuntu-pro-client (ubuntu-advantage-tools) VendorCanonical Affected before 37.3 Fixed in 37.3 Patch available CNA
  • Ubuntu 26.04 LTS VendorCanonical Affected — Fixed in 37.2ubuntu0.1 Patch available CNA
  • Ubuntu 24.04 LTS VendorCanonical Affected — Fixed in 37.2ubuntu~24.04.1 Patch available CNA
  • Ubuntu 22.04 LTS VendorCanonical Affected — Fixed in 37.2ubuntu~22.04.1 Patch available CNA
  • Ubuntu 20.04 LTS VendorCanonical Affected — Fixed in 37.1ubuntu0~20.04.1 Patch available CNA
  • Ubuntu 18.04 LTS VendorCanonical Affected — Fixed in 37.1ubuntu0~18.04.1 Patch available CNA
  • Ubuntu 16.04 LTS VendorCanonical Affected — Fixed in 37.1ubuntu0~16.04.1 Patch available CNA

Remediation

  • Fix · CNA ubuntu-pro-client (ubuntu-advantage-tools) (Canonical) Fixed in 37.3
  • Fix · CNA Ubuntu 26.04 LTS (Canonical) Fixed in 37.2ubuntu0.1
  • Fix · CNA Ubuntu 24.04 LTS (Canonical) Fixed in 37.2ubuntu~24.04.1
  • Fix · CNA Ubuntu 22.04 LTS (Canonical) Fixed in 37.2ubuntu~22.04.1
  • Fix · CNA Ubuntu 20.04 LTS (Canonical) Fixed in 37.1ubuntu0~20.04.1
  • Fix · CNA Ubuntu 18.04 LTS (Canonical) Fixed in 37.1ubuntu0~18.04.1
  • Fix · CNA Ubuntu 16.04 LTS (Canonical) Fixed in 37.1ubuntu0~16.04.1

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Canonical ubuntu-pro-client (ubuntu-advantage-tools) 37.3

    3 records Highest priority Priority MEDIUM 1 MEDIUM, 2 LOW

    Other records, highest priority first

    • TI-2026-09826 ubuntu-pro-client Input Validation Vulnerability Leading to Arbitrary APT Directive Injection and Remote Code ExecutionPriority MEDIUM 41
    • TI-2026-08340 ubuntu-pro-client Information Disclosure via Cleartext Bearer Token Exposure in Process Command LinePriority LOW 24
    Show all 3 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-12391
  2. 2026-10-03 Alias added: GHSA-whf7-7mxf-ww93

References

Other 1

  • TI-2020-09349 An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. KEVCVSS 3.1CRITICAL 9.8
  • TI-2020-05854 smtp_mailaddr in smtp_session.c in OpenSMTPD 6.6, as used in OpenBSD 6.6 and other… KEVCVSS 3.1CRITICAL 9.8
  • TI-2020-01431 Netlogon Elevation of Privilege Vulnerability KEVCVSS 3.1CRITICAL 10.0
  • TI-2019-12627 Exim 4.92 through 4.92.2 allows remote code execution, a different vulnerability than… KEVCVSS 3.1CRITICAL 9.8
  • TI-2019-08259 Underflow in PHP-FPM can lead to RCE KEVCVSS 3.1CRITICAL 9.8
  • TI-2019-07471 OS command injection in exim KEVCVSS 3.1CRITICAL 9.8
See all 4301 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences