Ubuntu Pro Client CVE-2026-11386

Exploitation requires the attacker to control the content of the Ubuntu Pro contract server response processed by ubuntu-pro-client during attach or refresh - concretely, one of: compromise of the contract/internal infrastructure serving directives, a machine-in-the-middle position using a CA the target host trusts, or a local logical bug that lets attacker data reach the response path. The exploitable inputs are the directives.suites[] and directives.aptURL fields (into which embedded \n newline characters inject arbitrary deb source lines because the client uses str.format() with no escaping/validation/newline filtering) and the additionalPackages[] field (passed positionally into a root-run apt-get install). Limiting factors: high attack complexity (AC:H) because the adversary must first achieve contract-response control rather than simply reach a network service; the system must actually perform an attach/refresh against the attacker-influenced channel; and the component must be present and attached (default on supported Ubuntu Server releases and auto-attached on cloud Ubuntu Pro images, which widens exposure). No target-side authentication or user interaction is required (PR:N/UI:N).

The CVSS 3.1 base score is 9.0 (Critical) with vector AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H: network vector, no privileges and no user interaction, but high attack complexity and a changed scope reflecting the crossing from a tampered network response into root-owned system configuration. The high-complexity metric is the key limiter - exploitation is not a simple unauthenticated request against a listening service; it requires the attacker to occupy a privileged position that lets them forge or alter the contract response (compromised internal/contract infrastructure, a machine-in-the-middle using a certificate trusted by the host, or a local logical bug). No EPSS score, SSVC decision, KEV entry, or POC was provided in the input, so probabilistic and real-world-exploitation signals are unknown rather than low - this should be stated plainly rather than read as 'low risk'. This is a genuine high-priority patching item because the impact is root RCE on a ubiquitously deployed component, but the practical barrier (control over the contract channel) means opportunistic mass exploitation is unlikely; the realistic threat model is a capable adversary who already has network position or infrastructure access, making it more relevant to targeted and supply-chain-style scenarios than internet-wide scanning.

An attacker who controls a malicious or compromised contract endpoint - or who can machine-in-the-middle the client using a certificate the host already trusts - returns a crafted contract response where directives.suites[] or directives.aptURL contains embedded newline characters plus an attacker package name in additionalPackages[]. When the pro client attaches or refreshes, it writes the injected deb source lines into a root-owned APT sources file and then runs apt-get install for the attacker's package, fetching and installing it as root. No public exploit code has been identified at time of analysis, but the flaw is deterministic once contract-response control is achieved.