ubuntu-pro-client CVE-2026-12391

Exploitation requires a local account with at least low privileges on the affected Ubuntu host and write access to the predictable path consumed by pro collect-logs - specifically the temporary directory or log staging location the tool uses before archiving. The attacker must create the symlink before a privileged operator executes the diagnostic command. The principal limiting factor - encoded as UI:R in the CVSS vector - is that an administrator must manually and explicitly run pro collect-logs; this is not a scheduled, daemon-triggered, or default cron operation under standard Ubuntu configurations. Exploitation is bounded to confidentiality only: the vulnerability exposes root-readable files to the local attacker but provides no write primitive and no availability impact (I:N, A:N). Scope is unchanged (S:U), meaning the flaw cannot be chained for container escape or lateral movement on its own. The attack does not require any non-default configuration - the pro collect-logs command is part of the standard ubuntu-pro-client package present on all supported Ubuntu LTS releases.

The CVSS 3.1 vector AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N encodes a local attack of low complexity requiring low privileges, with the critical limiting factor being UI:R - an administrator must actively invoke pro collect-logs, which is not a routine or automated Ubuntu operation. The high confidentiality impact (C:H) is well-founded: targets like /etc/shadow yield password hashes for offline cracking. No EPSS probability data was provided in the input, so statistical exploitation likelihood cannot be quantified. KEV status is absent, indicating no confirmed mass exploitation. The attack surface is further bounded by scope-unchanged (S:U): this is a local information disclosure path, not a pivot or container-escape primitive. Real-world priority is moderate - the attack is mechanically trivial once local access exists and the operator runs the diagnostic, but the UI:R gate means it cannot be automated against unsuspecting admins and is not self-triggering. Organizations running pro collect-logs in shared or multi-tenant environments (cloud instances, developer workstations, support workflows) face meaningfully higher exposure than those on single-user systems.

A low-privileged user on a multi-user Ubuntu system identifies the predictable temporary or log directory path consumed by pro collect-logs and creates a symbolic link at that path pointing to /etc/shadow. When a system administrator later runs pro collect-logs to generate a support bundle - for example, before opening a Canonical support ticket - the tool follows the attacker-controlled symlink, reads the shadow password file as root, and bundles its contents into the archive. The attacker then reads the archive to extract the hashed credentials and proceeds with offline password cracking.