PT-2026-60465 · Canonical · Ubuntu-Pro-Client

Bilal Teke · CVE-2026-9494 · Published 2026-07-16 · Updated 2026-07-17

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions ubuntu-pro-client (affected versions not specified)

Description An information disclosure issue exists where the client validates Ubuntu Pro APT credentials by executing the /usr/lib/apt/apt-helper using the download-file command. The secret bearer token is embedded in cleartext within the URL passed via command-line arguments (argv). On systems with a default-mounted /proc file system and disabled process-hiding mitigations like hidepid (a mount option that hides process information from users who do not own the process), an unprivileged local attacker can read the token from /proc/cmdline or /proc/<pid>/cmdline while the helper process is active. This allows unauthorized access to Ubuntu Pro or Expanded Security Maintenance (ESM) repositories.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. Enable hidepid on the /proc file system to prevent unprivileged users from viewing the command-line arguments of processes they do not own.

Weakness Enumeration

CWE-214

Related Identifiers

CVE-2026-9494

USN-8555-1

Affected Products

Ubuntu-Pro-Client

References · 9

• https://ubuntu.com/security/CVE-2026-9494 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-11386 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-8555-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-12391 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-9494 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-9494 · Security Note
• https://osv.dev/vulnerability/USN-8555-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-9494 · Security Note
• https://twitter.com/intraair/status/2077765848769417411 · Twitter Post