Ubuntu Pro for WSL EUVD-2026-88962

Requires a pre-existing unprivileged local account or process inside the same WSL instance running wsl-pro-service before 0.1.19ubuntu3, AND the /proc filesystem mounted without process-hiding (no hidepid) - which is the WSL default. The attacker must also hit the timing window while the root service is executing 'pro attach <token> --format=json', since the token is only exposed on the command line for the lifetime of that transient process (reflected in AT:P / AC:H). Limiting factors: no remote reachability (local only), prior authenticated foothold in the WSL instance needed, and the race-dependent, short-lived exposure window; enabling hidepid on /proc or upgrading to the patched version (which uses a 0600 temp config file) eliminates the exposure.

This is a genuine but modest-priority local information-disclosure flaw, not a high-severity remote issue. The vendor CVSS 4.0 vector (AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N) scores 5.7 (Medium) and is internally consistent with the description: exploitation is local (AV:L), requires an already-present unprivileged local account inside the WSL instance (PR:L), and depends on a timing race - the attacker can only read /proc/<pid>/cmdline while the transient 'pro attach' process is running (AT:P). Impact is confidentiality-only (VC:H, VI:N/VA:N) because the leaked Ubuntu Pro token grants access to a subscription but does not directly compromise integrity or availability of the host. No EPSS score, no CISA KEV listing, and no public exploit code were provided; per policy this is 'no public exploit identified at time of analysis'. The signals are not conflicting: local-only vector, race-window requirement, and prior local access all point to low real-world exploitability, so despite the sensitive nature of the token this is a lower-priority hardening fix rather than an urgent emergency. Patch availability is confirmed (Canonical PR #1816 / commit 11c164a3), which is the strongest mitigation signal.

An unprivileged local user or process already running inside a WSL instance repeatedly polls /proc/<pid>/cmdline for the wsl-pro-service child process; when the root service invokes 'pro attach <token> --format=json' during Ubuntu Pro enrollment, the full command line - including the plaintext token - is briefly world-readable because WSL mounts /proc without hidepid by default. The attacker captures the token and reuses it to attach attacker-controlled machines to the victim's Ubuntu Pro subscription. No public exploit code was identified, and success depends on winning the race against the short-lived attach process.