EUVD-2026-44910
GHSA-4m5m-x42p-vrwg
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Local-only /proc read attack requires existing low-privilege account (PR:L, AV:L); full token disclosure warrants C:H with no integrity or availability impact.
Primary rating from Vendor (canonical).
CVSS VectorVendor: canonical
Lifecycle Timeline
2DescriptionCVE.org
An information disclosure vulnerability exists in Canonical ubuntu-pro-client (formerly ubuntu-advantage-tools). The client validates Ubuntu Pro APT credentials by executing /usr/lib/apt/apt-helper using the download-file command. During this process, the secret bearer token is embedded directly in the cleartext URL component passed via the command-line arguments (argv), resulting in a URL format such as https://bearer:<token>@esm.ubuntu.com/.../. On systems utilizing a default-mounted /proc file system where process-hiding mitigations (such as hidepid) are disabled, an unprivileged local attacker can monitor system processes and read the sensitive bearer token directly from /proc/cmdline while the helper process is actively running. This leaked token can subsequently be used to gain unauthorized access to the victim's Ubuntu Pro or Expanded Security Maintenance (ESM) repositories.
AnalysisAI
ubuntu-pro-client (formerly ubuntu-advantage-tools) leaks Ubuntu Pro bearer tokens to unprivileged local users via the Linux /proc filesystem on all supported Ubuntu LTS releases from 14.04 through 26.04. When the client validates APT credentials, it spawns /usr/lib/apt/apt-helper with the secret token embedded in a cleartext URL argument (https://bearer:<token>@esm.ubuntu.com/), which any local low-privileged user can read from /proc/<pid>/cmdline on default-configured systems. The stolen token enables unauthorized access to the victim's Ubuntu Pro ESM repositories. No public exploit has been identified at time of analysis, and this is not listed in CISA KEV.
Technical ContextAI
CWE-214 (Invocation of Process Using Visible Sensitive Information) is the precise root cause: the ubuntu-pro-client credential validation logic constructs a URL embedding a secret bearer token directly in argv when invoking the /usr/lib/apt/apt-helper subprocess with the download-file command. On Linux, all process argv data is exposed in /proc/<pid>/cmdline and is readable by any user with filesystem access to /proc. Ubuntu's default /proc mount does not apply hidepid restrictions, meaning no special privilege is required to read another process's command line. The CPE strings confirm the affected component is cpe:2.3:a:canonical:ubuntu-pro-client_(ubuntu-advantage-tools):*:*:*:*:*:*:*:* running across Ubuntu LTS releases 14.04 through 26.04 - a span covering over a decade of supported Ubuntu deployments. The ESM bearer token grants authenticated access to Canonical's Expanded Security Maintenance package repositories, making its theft a meaningful credential compromise.
RemediationAI
The primary fix is to upgrade ubuntu-pro-client to the patched package version via 'sudo apt update && sudo apt install ubuntu-advantage-tools'; consult the Canonical advisory at https://ubuntu.com/security/CVE-2026-9494 for the exact fixed version number, which was not confirmed in available data at time of analysis. As an immediate compensating control, administrators can remount /proc with hidepid=2 ('sudo mount -o remount,hidepid=2,gid=<proc-gid> /proc') and persist the setting in /etc/fstab - this restricts /proc/<pid>/cmdline visibility so that unprivileged users can only read their own process command lines. Note that hidepid=2 can break monitoring agents, container runtimes, and system services that read other processes' /proc entries; test thoroughly before deploying broadly. A less disruptive alternative is hidepid=1, which hides cmdline from non-owners but still exposes process metadata. Reducing the number of local user accounts on systems running ubuntu-pro-client narrows the exposed attack surface but does not eliminate the vulnerability.
More in Ubuntu 20 04 Lts
View allLocal privilege escalation in snapd on multiple Ubuntu versions allows authenticated local attackers to obtain root acce
Root-level remote code execution in Canonical's ubuntu-pro-client (formerly ubuntu-advantage-tools) allows an attacker w
TLS trust store poisoning in Canonical ADSys through v0.16.2 allows a network-positioned attacker to inject an arbitrary
Sandbox confinement bypass in Canonical snapd (snap-confine) affects all supported Ubuntu LTS releases (16.04 through 26
Insecure symlink following in Canonical's ubuntu-pro-client `pro collect-logs` command allows a low-privileged local att
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today