CVE-2026-9494— ubuntu-pro-client Information Disclosure via Cleartext Bearer Token Exposure in Process Command Line
Quick assessment
Affected
Canonical ubuntu-pro-client (ubuntu-advantage-tools)
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Canonical ubuntu-advantage-tools是英国Canonical公司的一款系统管理工具套件。 Canonical ubuntu-advantage-tools 37.3之前版本存在信息泄露漏洞，该漏洞源于客户端执行/usr/lib/apt/apt-helper使用download-file命令时，将秘密bearer令牌直接嵌入到通过命令行参数传递的明文URL组件中，在系统使用默认挂载的/proc文件系统且未启用进程隐藏缓解措施时，本地非特权攻击者可监控系统进程并从/proc/cmd
Affected Version Matrix 8
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Canonical | Ubuntu 14.04 LTS | 19.7ubuntu0.1 |
unaffected |
| Canonical | Ubuntu 16.04 LTS | 37.1ubuntu0~16.04.1 |
unaffected |
| Canonical | Ubuntu 18.04 LTS | 37.1ubuntu0~18.04.1 |
unaffected |
| Canonical | Ubuntu 20.04 LTS | 37.1ubuntu0~20.04.1 |
unaffected |
| Canonical | Ubuntu 22.04 LTS | 37.2ubuntu~22.04.1 |
unaffected |
| Canonical | Ubuntu 24.04 LTS | 37.2ubuntu~24.04.1 |
unaffected |
| Canonical | Ubuntu 26.04 LTS | 37.2ubuntu0.1 |
unaffected |
| Canonical | ubuntu-pro-client (ubuntu-advantage-tools) | < 37.3 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-9494
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
ubuntu-pro-client Information Disclosure via Cleartext Bearer Token Exposure in Process Command Line
Source: CVE Program / CVE List V5
Vulnerability Description
An information disclosure vulnerability exists in Canonical ubuntu-pro-client (formerly ubuntu-advantage-tools). The client validates Ubuntu Pro APT credentials by executing /usr/lib/apt/apt-helper using the download-file command. During this process, the secret bearer token is embedded directly in
the cleartext URL component passed via the command-line arguments (argv), resulting in a URL format such as https://bearer:<token>@esm.ubuntu.com/.../. On systems utilizing a default-mounted /proc file system where process-hiding mitigations (such as hidepid) are disabled, an unprivileged local attacker can
monitor system processes and read the sensitive bearer token directly from /proc/cmdline while the helper process is actively running. This leaked token can subsequently be used to gain unauthorized access to the victim's Ubuntu Pro or Expanded Security Maintenance (ESM) repositories.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
通过处理环境导致的信息暴露
Source: CVE Program / CVE List V5
Vulnerability Title
Canonical ubuntu-advantage-tools 信息泄露漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Canonical ubuntu-advantage-tools是英国Canonical公司的一款系统管理工具套件。 Canonical ubuntu-advantage-tools 37.3之前版本存在信息泄露漏洞，该漏洞源于客户端执行/usr/lib/apt/apt-helper使用download-file命令时，将秘密bearer令牌直接嵌入到通过命令行参数传递的明文URL组件中，在系统使用默认挂载的/proc文件系统且未启用进程隐藏缓解措施时，本地非特权攻击者可监控系统进程并从/proc/cmd
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Canonical | ubuntu-pro-client (ubuntu-advantage-tools) | 0 ~ 37.3 | - |
|
| Canonical | Ubuntu 26.04 LTS | 37.2ubuntu0.1 | - |
|
| Canonical | Ubuntu 24.04 LTS | 37.2ubuntu~24.04.1 | - |
|
| Canonical | Ubuntu 22.04 LTS | 37.2ubuntu~22.04.1 | - |
|
| Canonical | Ubuntu 20.04 LTS | 37.1ubuntu0~20.04.1 | - |
|
| Canonical | Ubuntu 18.04 LTS | 37.1ubuntu0~18.04.1 | - |
|
| Canonical | Ubuntu 16.04 LTS | 37.1ubuntu0~16.04.1 | - |
|
| Canonical | Ubuntu 14.04 LTS | 19.7ubuntu0.1 | - |
|
II. Public POCs for CVE-2026-9494
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-9494
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-9494 (1)
-
🔗 500: Server error | Ubuntu vdb-entry
Same Patch Batch · Canonical · 2026-07-16 · 3 CVEs total
| CVE-2026-11386 | 9.0 CRITICAL | ubuntu-pro-client Input Validation Vulnerability Leading to Arbitrary APT Directive Inject |
| CVE-2026-12391 | 5.0 MEDIUM | ubuntu-pro-client Local Privilege Escalation and Information Disclosure via Symlink Arbitr |
IV. Related Vulnerabilities
Same vendor: Canonical
-
CVE-2026-102371
wsl-pro-service: Ubuntu Pro token exposed via process comman -
CVE-2026-87798
LXD client recursive file pull allows directory escape via m -
CVE-2026-87799
Arbitrary file write on LXD host via symlink in migration st -
CVE-2026-97335
Incorrect authorization in LXD storage volume API allows rea -
CVE-2026-85185
Path traversal in LXD btrfs storage driver allows arbitrary
Same weakness: CWE-214
-
CVE-2026-102371
wsl-pro-service: Ubuntu Pro token exposed via process comman -
CVE-2026-61670
microsandbox: Secret values exposed in world-readable proces -
CVE-2026-92768
Cockpit-machines: cockpit-machines: sensitive data exposure -
CVE-2026-92747
Cockpit-machines: cockpit-machines: sensitive data exposure -
CVE-2026-92745
Cockpit-machines: cockpit-machines: information disclosure o
V. Comments for CVE-2026-9494
No comments yet