EUVD-2026-44912
GHSA-whf7-7mxf-ww93
Severity by source
AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
Local vector and PR:L because symlink pre-placement requires a local account; UI:R because a privileged admin must manually invoke the diagnostic command; C:H for potential /etc/shadow disclosure; no integrity or availability impact applies.
Primary rating from Vendor (canonical).
CVSS VectorVendor: canonical
Lifecycle Timeline
2DescriptionCVE.org
An insecure symlink following vulnerability exists in Canonical ubuntu-pro-client (formerly ubuntu-advantage-tools) within the pro collect-logs command framework. The utility creates or utilizes predictable temporary file paths or user-accessible log directories when gathering diagnostic information without verifying the file type or ownership. An unprivileged local attacker can exploit this behavior by creating a symbolic link (symlink) at a predictable destination path pointing to an arbitrary, root-readable file (such as /etc/shadow or private files within /root). When a root administrator or operator subsequently executes the pro collect-logs command, the tool follows the user-controlled symlink, reads the target file, and compresses its contents into the resulting diagnostic support archive. Because the output archive remains readable by the unprivileged user, the attacker can extract and read the sensitive root-owned files, leading to a complete information disclosure of system secrets.
AnalysisAI
Insecure symlink following in Canonical's ubuntu-pro-client pro collect-logs command allows a low-privileged local attacker to cause a root-executing diagnostic tool to read arbitrary root-owned files - including /etc/shadow - and bundle their contents into a support archive accessible to the attacker. All supported Ubuntu LTS releases from 16.04 through 26.04 are affected, as confirmed by Canonical's own advisory and CPE data spanning the full product history. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis, but the attack primitive is trivially simple - standard Unix symlink creation - making exploitation straightforward once local access is obtained.
Technical ContextAI
CWE-59 (Improper Link Resolution Before File Access, 'Link Following') describes the root cause: the pro collect-logs subcommand within ubuntu-pro-client (formerly ubuntu-advantage-tools) aggregates diagnostic data using predictable temporary file paths or log directory locations without performing file-type or ownership checks before reading. This classic symlink-following pattern does not require a race condition - the attacker pre-positions the symlink before the privileged command executes, removing any timing dependency. The affected package is identified by CPE cpe:2.3:a:canonical:ubuntu-pro-client_(ubuntu-advantage-tools):*:*:*:*:*:*:*:*, with separate CPE entries confirming exposure across Ubuntu 16.04, 18.04, 20.04, 22.04, 24.04, and 26.04 LTS. The tool runs as root (required to collect system-wide diagnostics), and the resulting archive is returned to - and readable by - the invoking or requesting user, closing the exfiltration loop.
RemediationAI
The primary fix is to upgrade ubuntu-pro-client to the patched version published by Canonical; consult the vendor advisory at https://ubuntu.com/security/CVE-2026-12391 for exact fixed package versions, as no specific patched release was confirmed in the available input data - patch availability is stated as available per vendor advisory but the version cannot be independently confirmed from the provided references. As a compensating control, restrict local shell access on systems where pro collect-logs is routinely used, minimizing the attacker's ability to pre-position symlinks. When collecting diagnostic logs from production systems with untrusted local users, consider running pro collect-logs on an isolated snapshot or container rather than directly on the affected host, since this eliminates the shared filesystem required for symlink pre-placement. Operators should also inspect the resulting log archive before distributing it to ensure no unexpected root-owned files were inadvertently included.
Root-level remote code execution in Canonical's ubuntu-pro-client (formerly ubuntu-advantage-tools) allows an attacker w
ubuntu-pro-client (formerly ubuntu-advantage-tools) leaks Ubuntu Pro bearer tokens to unprivileged local users via the L
Same weakness CWE-59 – Improper Link Resolution Before File Access
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today