EUVD-2026-44911
GHSA-9836-vm3x-qwmj
Severity by source
AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Network-delivered via the contract channel with no target-side privileges or interaction, but AC:H because the attacker must first control or spoof the contract response; scope changes as tampered data becomes root config, yielding full C/I/A impact.
Primary rating from Vendor (canonical).
CVSS VectorVendor: canonical
Lifecycle Timeline
2DescriptionCVE.org
An input validation and injection vulnerability exists in Canonical ubuntu-pro-client (formerly ubuntu-advantage-tools). The client constructs APT source files (such as /etc/apt/sources.list.d/ubuntu-.list or their DEB822 equivalents) using data received directly from the contract server response via the directives.suites[] and directives.aptURL fields. Because the client utilizes Python's str.format() to write these files without performing escaping, validation, or newline character filtering, a malicious or tampered contract response containing embedded newline (\n) characters can successfully inject arbitrary, attacker-controlled deb configuration lines into root-owned APT sources. When combined with the unvalidated additionalPackages[] field-which is passed positionally into a root-executed apt-get install command-an attacker capable of spoofing or manipulating the contract response (e.g., via a compromised internal infrastructure, an intercepted connection utilizing a trusted CA, or local logical bugs) can force the client to fetch and install malicious packages. This ultimately leads to arbitrary code execution with root privileges on the affected system. This component is preinstalled on supported Ubuntu Server releases and auto-attaches by default on cloud provider Ubuntu Pro images.
Articles & Coverage 1
AnalysisAI
Root-level remote code execution in Canonical's ubuntu-pro-client (formerly ubuntu-advantage-tools) allows an attacker who can spoof or tamper with the Ubuntu Pro contract server response to inject arbitrary APT source lines and install malicious root-owned packages. The client builds /etc/apt/sources.list.d entries from the server's directives.suites[] and directives.aptURL fields via Python str.format() without escaping or newline filtering, and passes additionalPackages[] positionally into a root-run apt-get install. Because the component is preinstalled on supported Ubuntu Server releases and auto-attaches on cloud Ubuntu Pro images the exposure is broad; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Technical ContextAI
The affected component is ubuntu-pro-client, the Python-based agent that attaches an Ubuntu system to Canonical's Ubuntu Pro/Advantage contract service to enable entitlements such as ESM, Livepatch and FIPS. During attach/refresh the client receives a JSON contract response and writes APT repository configuration files (classic sources.list.d/ubuntu-*.list files or their DEB822 equivalents) by interpolating server-supplied strings - directives.suites[] and directives.aptURL - into templates using Python's str.format(). Per CWE-20 (Improper Input Validation), the client performs no escaping, validation, or newline stripping on this data, so a value containing embedded \n characters breaks out of the intended single-line directive and injects additional attacker-controlled deb configuration lines into a root-owned file. The unvalidated additionalPackages[] field compounds this: its entries are passed positionally into a root-executed apt-get install, so injected sources plus an attacker-chosen package name yield code execution as root. The trust assumption being violated is that the contract server response is authentic and well-formed.
RemediationAI
Apply the Canonical-provided update to ubuntu-pro-client as soon as it is available - patch status: no exact fix version is present in the provided input, so treat the fixed version per Ubuntu release as authoritative from the advisory at https://ubuntu.com/security/CVE-2026-11386, and run 'apt-get update && apt-get install --only-upgrade ubuntu-advantage-tools ubuntu-pro-client' after confirming the target version there. Because exploitation depends on tampering with the contract channel, effective compensating controls until patched are: ensure the client only communicates with the legitimate Canonical contract endpoint over strictly validated TLS and restrict/monitor egress so the contract host cannot be redirected (side effect: may break air-gapped or proxy-based Pro attachment); on cloud images, avoid or gate the default auto-attach on untrusted networks (side effect: entitlements such as ESM/Livepatch will not activate automatically); and audit /etc/apt/sources.list.d/ubuntu-*.list and DEB822 files for unexpected or multi-line entries while monitoring apt-get install invocations originating from the pro client. Do not rely on these controls as a substitute for the vendor patch, since a trusted-CA machine-in-the-middle can defeat TLS-only assumptions.
Wazuh SIEM platform versions 4.4.0 through 4.9.0 contain an unsafe deserialization vulnerability in the DistributedAPI t
BentoML version 1.4.2 and earlier contains an unauthenticated remote code execution vulnerability through insecure deser
pgAdmin 4 contains critical remote code execution vulnerabilities in the Query Tool download and Cloud Deployment endpoi
The renderLocalView function in render/views.py in graphite-web in Graphite 0.9.5 through 0.9.10 uses the pickle Python
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Rated critica
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
pyLoad download manager version prior to 0.5.0b3.dev77 exposes the Flask SECRET_KEY through an unauthenticated endpoint.
Langflow (a visual LLM pipeline builder) contains a critical unauthenticated code execution vulnerability (CVE-2026-3301
In Mercurial before 4.1.3, "hg serve --stdio" allows remote authenticated users to launch the Python debugger, and conse
Unauthenticated remote code execution affects Kestra OSS (the open-source event-driven orchestration platform) prior to
Unauthenticated remote code execution in Marimo ≤0.20.4 allows attackers to execute arbitrary system commands via the `/
pyLoad is the free and open-source Download Manager written in pure Python. Rated medium severity (CVSS 5.3), this vulne
Same weakness CWE-20 – Improper Input Validation
View allShare
External POC / Exploit Code
Leaving vuln.today