Summary
Bilal Teke discovered that Ubuntu Advantage Tools exposed the Pro bearer
token in command-line arguments when validating APT credentials. A local
attacker could possibly use this issue to obtain sensitive information
and gain unauthorized access to Ubuntu Pro repositories. (CVE-2026-9494)
Frederick Jerusha discovered that Ubuntu Advantage Tools did not properly
validate data received from the contract server when writing APT source
files. An attacker could possibly use this issue to inject arbitrary APT
configuration and execute arbitrary code. (CVE-2026-11386)
Mateusz Gierblinski discovered that Ubuntu Advantage Tools did not
properly handle symbolic links when collecting diagnostic logs. A local
attacker could possibly use this issue to obtain sensitive information
from files owned by the administrator. This issue only affected Ubuntu
16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS,
Ubuntu 24.04 LTS and Ubuntu 26.04 LTS. (CVE-2026-12391)
Fixed packages 7
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 14.04 LTS 14.04:LTS | ubuntu-advantage-tools | 19.7ubuntu0.1 |
| Ubuntu · 16.04 LTS 16.04:LTS | ubuntu-advantage-tools | 37.1ubuntu0~16.04.1 |
| Ubuntu · 18.04 LTS 18.04:LTS | ubuntu-advantage-tools | 37.1ubuntu0~18.04.1 |
| Ubuntu · 20.04 LTS 20.04:LTS | ubuntu-advantage-tools | 37.1ubuntu0~20.04.1 |
| Ubuntu · 22.04 LTS 22.04:LTS | ubuntu-advantage-tools | 37.2ubuntu~22.04.1 |
| Ubuntu · 24.04 LTS 24.04:LTS | ubuntu-advantage-tools | 37.2ubuntu~24.04.1 |
| Ubuntu · 26.04 LTS 26.04:LTS | ubuntu-advantage-tools | 37.2ubuntu0.1 |
Vulnerabilities 3
-
Critical 9.0
ubuntu-pro-client Input Validation Vulnerability Leading to Arbitrary APT Directive Injection and Remote Code Execution
An input validation and injection vulnerability exists in Canonical ubuntu-pro-client (formerly ubuntu-advantage-tools). The client constructs APT source files (such as /etc/apt/sources.list.d/ubuntu-.list or their DEB822 equivalents) using data received dire…
-
Medium 5.5
ubuntu-pro-client Information Disclosure via Cleartext Bearer Token Exposure in Process Command Line
An information disclosure vulnerability exists in Canonical ubuntu-pro-client (formerly ubuntu-advantage-tools). The client validates Ubuntu Pro APT credentials by executing /usr/lib/apt/apt-helper using the download-file command. During this process, the sec…
-
Medium 5.0
ubuntu-pro-client Local Privilege Escalation and Information Disclosure via Symlink Arbitrary File Read in collect-logs
An insecure symlink following vulnerability exists in Canonical ubuntu-pro-client (formerly ubuntu-advantage-tools) within the pro collect-logs command framework. The utility creates or utilizes predictable temporary file paths or user-accessible log director…