CVE-2026-9494
An information disclosure vulnerability exists in Canonical ubuntu-pro-client (formerly ubuntu-advantage-tools). The client validates Ubuntu Pro APT credentials by executing /usr/lib/apt/apt-helper using the download-file command. During this process, the secret bearer token is embedded directly in the cleartext URL component passed via the command-line arguments (argv), resulting in a URL format such as https://bearer:<token>@esm.ubuntu.com/.../. On systems utilizing a default-mounted /proc file system where process-hiding mitigations (such as hidepid) are disabled, an unprivileged local attacker can monitor system processes and read the sensitive bearer token directly from /proc/cmdline while the helper process is actively running. This leaked token can subsequently be used to gain unauthorized access to the victim's Ubuntu Pro or Expanded Security Maintenance (ESM) repositories.
- Score
- CVSS 3.1 5.5 Medium
- Status
- Undergoing Analysis - security@ubuntu.com
- Published
- 2026-07-16
- Last modified
- 2026-07-16
- Weaknesses
- CWE-214
Affected products
- Ubuntu-pro-client Ubuntu-advantage-tools (Canonical)
- Ubuntu 14.04 Lts (Canonical)
- Ubuntu 16.04 Lts (Canonical)
- Ubuntu 18.04 Lts (Canonical)
- Ubuntu 20.04 Lts (Canonical)
- Ubuntu 22.04 Lts (Canonical)
- Ubuntu 24.04 Lts (Canonical)
- Ubuntu 26.04 Lts (Canonical)
References
- https://ubuntu.com/security/CVE-2026-9494
