ubuntu-pro-client CVE-2026-9494

Exploitation requires three concurrent conditions: (1) the attacker possesses a local low-privileged account on the target system (confirmed by PR:L in the CVSS vector); (2) the target system's /proc filesystem is mounted without hidepid restrictions - this is the Ubuntu default across all affected LTS versions and requires no special configuration to be present; and (3) ubuntu-pro-client must be actively executing credential validation (e.g., during 'apt update', 'pro attach', or ESM repository access), causing apt-helper to be spawned with the token-bearing URL in argv. The exploitation window is limited to the subprocess lifetime, requiring timing or automated polling of /proc. Systems hardened with hidepid=1 or hidepid=2 are not exploitable. Remote exploitation is not possible - the AV:L CVSS vector confirms this is strictly a local attack requiring a pre-existing account on the machine.

The NVD CVSS 5.5 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) is well-calibrated to the actual threat: exploitation is local-only and requires an existing low-privileged account, but once those conditions are met, token extraction is straightforward with no special tooling. The High confidentiality impact is appropriate - a full credential token is disclosed. No EPSS score was provided, preventing probabilistic exploitation rate comparison. The vulnerability is not in CISA KEV and no public exploit code has been identified. Real-world risk is elevated on multi-tenant systems - shared developer workstations, cloud VMs, CI/CD runners, and university lab machines - where local unprivileged accounts are routine. Exploitation is constrained by a timing race window (the apt-helper process must be actively running), but automated polling of /proc trivially closes this gap. Default Ubuntu deployments lacking hidepid hardening are confirmed vulnerable per the description, supporting AC:L. Missing data: no EPSS score and no confirmed patched package version are available in the provided intelligence.

A low-privileged attacker on a shared Ubuntu server runs a tight polling loop reading all entries under /proc/*/cmdline, waiting for the apt-helper process to appear during a scheduled 'apt update' or 'pro attach' operation. The moment the helper spawns, the attacker captures the full URL argument containing the bearer token in the format https://bearer:<token>@esm.ubuntu.com/ before the short-lived process exits. The attacker then uses the token to authenticate directly against Canonical's ESM repositories, gaining access to security patch metadata and packages associated with the victim's Ubuntu Pro subscription.