Skip to content
OpenAdvisories
Medium USN-8892-1 1 CVE

wsl-pro-service vulnerability

Published Oct 6, 2026 · Updated Oct 7, 2026

Ecosystem: Ubuntu

Summary

Darshan U discovered that Ubuntu Pro for WSL exposed the attach token in
command-line arguments when enabling a subscription on a WSL instance.
An attacker could possibly use this issue to obtain sensitive information
and gain unauthorized access to Ubuntu Pro repositories.

Fixed packages 4

ReleasePackageFixed in
Ubuntu · 22.04 LTS 22.04:LTS wsl-pro-service 0.1.18~22.04.3
Ubuntu · 24.04 LTS 24.04:LTS wsl-pro-service 0.1.18~24.04.4
Ubuntu · 26.04 LTS 26.04:LTS wsl-pro-service 0.1.19ubuntu2.1
Ubuntu · Pro 20.04 LTS Pro:20.04:LTS wsl-pro-service 0.1.18~20.04.2+esm1

Vulnerabilities 1

  • Medium 5.7
    CVE-2026-102371

    wsl-pro-service: Ubuntu Pro token exposed via process command-line arguments

    In wsl-pro-service before 0.1.19ubuntu3, the service component which runs as root inside each WSL instance attaches the instance to Ubuntu Pro by executing the pro client with the Ubuntu Pro token passed as a command-line argument (pro attach <token>). On sys…

    Canonical Ubuntu Pro for WSL wsl-pro-service Ubuntu

References

  • report
    https://ubuntu.com/security/CVE-2026-102371