Vulnerabilities

TI-2026-10639 CVE-2026-12391 · GHSA-whf7-7mxf-ww93

ubuntu-pro-client Local Privilege Escalation and Information Disclosure via Symlink Arbitrary File Read in collect-logs

LOW 22

An insecure symlink following vulnerability exists in Canonical ubuntu-pro-client (formerly ubuntu-advantage-tools) within the pro collect-logs command framework.

CVSS 3.1MEDIUM 5.0 Local Low privileges User interaction EPSS 0.00206 Published 2026-07-16 Fixed in 37.3, 37.2ubuntu0.1 +5 CWE-59

TI-2026-09826 CVE-2026-11386 · GHSA-9836-vm3x-qwmj

ubuntu-pro-client Input Validation Vulnerability Leading to Arbitrary APT Directive Injection and Remote Code Execution

MEDIUM 41

An input validation and injection vulnerability exists in Canonical ubuntu-pro-client (formerly ubuntu-advantage-tools).

CVSS 3.1CRITICAL 9.0 Network No auth No interaction EPSS 0.00526 Published 2026-07-16 Fixed in 37.3, 37.2ubuntu0.1 +6 CWE-20

TI-2026-08340 CVE-2026-9494 · GHSA-4m5m-x42p-vrwg

ubuntu-pro-client Information Disclosure via Cleartext Bearer Token Exposure in Process Command Line

LOW 24

An information disclosure vulnerability exists in Canonical ubuntu-pro-client (formerly ubuntu-advantage-tools).

CVSS 3.1MEDIUM 5.5 Local Low privileges No interaction EPSS 0.00146 Published 2026-07-16 Fixed in 37.3, 37.2ubuntu0.1 +6 CWE-214

Vulnerabilities

Filters

ubuntu-pro-client Local Privilege Escalation and Information Disclosure via Symlink Arbitrary File Read in collect-logs

ubuntu-pro-client Input Validation Vulnerability Leading to Arbitrary APT Directive Injection and Remote Code Execution

ubuntu-pro-client Information Disclosure via Cleartext Bearer Token Exposure in Process Command Line