CVE-2026-102371— wsl-pro-service: Ubuntu Pro token exposed via process command-line arguments
Quick assessment
Affected
Canonical Ubuntu Pro for WSL
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
In wsl-pro-service before 0.1.19ubuntu3, the service component which runs as root inside each WSL instance attaches the instance to Ubuntu Pro by executing the pro client with the Ubuntu Pro token passed as a command-line argument (pro attach <token>). On syst
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-102371
Vulnerability Information
Shenlong is analyzing...
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
wsl-pro-service: Ubuntu Pro token exposed via process command-line arguments
Source: CVE Program / CVE List V5
Vulnerability Description
In wsl-pro-service before 0.1.19ubuntu3, the service component which runs as root inside each WSL instance attaches the instance to Ubuntu Pro by executing the pro client with the Ubuntu Pro token passed as a command-line argument (pro attach <token>). On systems where /proc is mounted without process-hiding mitigations (such as hidepid), which is the default in WSL, an unprivileged local user or process in the same WSL instance can read the token from /proc/<pid>/cmdline while the attach process is running. The leaked token could then be used to attach other machines to the victim's Ubuntu Pro subscription and gain unauthorized access to Ubuntu Pro services.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
通过处理环境导致的信息暴露
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Canonical | Ubuntu Pro for WSL | 0.1.1 ~ 0.1.19ubuntu2 | - |
|
II. Public POCs for CVE-2026-102371
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-102371
请登录查看更多情报信息。
Other References for CVE-2026-102371 (3)
-
https://ubuntu.com/security/CVE-2026-102371 vendor-advisory
IV. Related Vulnerabilities
Same vendor: Canonical
-
CVE-2026-87798
LXD client recursive file pull allows directory escape via m -
CVE-2026-87799
Arbitrary file write on LXD host via symlink in migration st -
CVE-2026-97335
Incorrect authorization in LXD storage volume API allows rea -
CVE-2026-85185
Path traversal in LXD btrfs storage driver allows arbitrary -
CVE-2026-85526
Path traversal via Btrfs optimized-backup subvolumes[].path
Same weakness: CWE-214
-
CVE-2026-61670
microsandbox: Secret values exposed in world-readable proces -
CVE-2026-92768
Cockpit-machines: cockpit-machines: sensitive data exposure -
CVE-2026-92747
Cockpit-machines: cockpit-machines: sensitive data exposure -
CVE-2026-92745
Cockpit-machines: cockpit-machines: information disclosure o -
CVE-2026-81684
openssl_encrypt before 1.4.9 Information Disclosure via Comm
V. Comments for CVE-2026-102371
No comments yet