Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS : Ubuntu Pro for WSL vulnerability (USN-8892-1)

The remote Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-8892-1 advisory. Darshan U discovered that Ubuntu Pro for WSL exposed the attach token in command-line arguments when enabling a subscription o...

USN-8892-1: Ubuntu Pro for WSL vulnerability

Darshan U discovered that Ubuntu Pro for WSL exposed the attach token in command-line arguments when enabling a subscription on a WSL instance. An attacker could possibly use this issue to obtain sensitive information and gain unauthorized access to Ubuntu Pro repositories...

USN-8892-1 wsl-pro-service vulnerability

Darshan U discovered that Ubuntu Pro for WSL exposed the attach token in command-line arguments when enabling a subscription on a WSL instance. An attacker could possibly use this issue to obtain sensitive information and gain unauthorized access to Ubuntu Pro repositories...

Linux Distros Unpatched Vulnerability : CVE-2026-102371

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In wsl-pro-service before 0.1.19ubuntu3, the service component which runs as root inside each WSL instance attaches the instance to Ubuntu Pro by executing the...

CVE-2026-102371

In wsl-pro-service before 0.1.19ubuntu3, the service component which runs as root inside each WSL instance attaches the instance to Ubuntu Pro by executing the pro client with the Ubuntu Pro token passed as a command-line argument pro attach . On systems where /proc is mounted without...

UBUNTU-CVE-2026-102371

In wsl-pro-service before 0.1.19ubuntu3, the service component which runs as root inside each WSL instance attaches the instance to Ubuntu Pro by executing the pro client with the Ubuntu Pro token passed as a command-line argument pro attach . On systems where /proc is mounted without...

CVE-2026-102371 wsl-pro-service: Ubuntu Pro token exposed via process command-line arguments

In wsl-pro-service before 0.1.19ubuntu3, the service component which runs as root inside each WSL instance attaches the instance to Ubuntu Pro by executing the pro client with the Ubuntu Pro token passed as a command-line argument pro attach . On systems where /proc is mounted without...

CVE-2026-102371 wsl-pro-service: Ubuntu Pro token exposed via process command-line arguments

In wsl-pro-service before 0.1.19ubuntu3, the service component which runs as root inside each WSL instance attaches the instance to Ubuntu Pro by executing the pro client with the Ubuntu Pro token passed as a command-line argument pro attach . On systems where /proc is mounted without...

EUVD-2026-88962

In wsl-pro-service before 0.1.19ubuntu3, the service component which runs as root inside each WSL instance attaches the instance to Ubuntu Pro by executing the pro client with the Ubuntu Pro token passed as a command-line argument pro attach . On systems where /proc is mounted without...

CVE-2026-102371

In wsl-pro-service before 0.1.19ubuntu3, the service component which runs as root inside each WSL instance attaches the instance to Ubuntu Pro by executing the pro client with the Ubuntu Pro token passed as a command-line argument pro attach . On systems where /proc is mounted without...

CVE-2026-102371 wsl-pro-service: Ubuntu Pro token exposed via process command-line arguments

In wsl-pro-service before 0.1.19ubuntu3, the service component which runs as root inside each WSL instance attaches the instance to Ubuntu Pro by executing the pro client with the Ubuntu Pro token passed as a command-line argument pro attach . On systems where /proc is mounted without...

CVE-2026-102371

The wsl-pro-service component (versions before 0.1.19ubuntu3 ) is vulnerable to information disclosure because it passes an Ubuntu Pro token as a command-line argument during the execution of the pro attach command. Since WSL defaults to mounting /proc without process-hiding mitigations like hide...

CVE-2026-102371: Invocation of Process Using Visible Sensitive Information

In wsl-pro-service before 0.1.19ubuntu3, the service component which runs as root inside each WSL instance attaches the instance to Ubuntu Pro by executing the pro client with the Ubuntu Pro token passed as a command-line argument pro attach . On systems where /proc is mounted without...

CVE-2026-102371

In wsl-pro-service before 0.1.19ubuntu3, the service component which runs as root inside each WSL instance attaches the instance to Ubuntu Pro by executing the pro client with the Ubuntu Pro token passed as a command-line argument pro attach . On systems where /proc is mounted without...

PT-2026-102618

Name of the Vulnerable Software and Affected Versions wsl-pro-service versions prior to 0.1.19ubuntu3 Description A service component running as root within a WSL instance attaches the instance to Ubuntu Pro by executing the pro client and passing the Ubuntu Pro token as a command-line argument. ...

Ubuntu 24.04 LTS / 26.04 LTS / Pro Realtime 24.04 LTS : Sudo vulnerability (USN-8803-1)

The remote Ubuntu 24.04 LTS / 26.04 LTS / Pro Realtime 24.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-8803-1 advisory. Guannan Wang, Zhanpeng Liu, and Guancheng Li discovered that Sudo failed to apply intercept policy checks when commands were...

UBUNTU-CVE-2026-11386

An input validation and injection vulnerability exists in Canonical ubuntu-pro-client formerly ubuntu-advantage-tools. The client constructs APT source files such as /etc/apt/sources.list.d/ubuntu-.list or their DEB822 equivalents using data received directly from the contract server response via...

CVE-2026-11386

An input validation and injection vulnerability exists in Canonical ubuntu-pro-client formerly ubuntu-advantage-tools. The client constructs APT source files such as /etc/apt/sources.list.d/ubuntu-.list or their DEB822 equivalents using data received directly from the contract server response via...

UBUNTU-CVE-2026-9494

An information disclosure vulnerability exists in Canonical ubuntu-pro-client formerly ubuntu-advantage-tools. The client validates Ubuntu Pro APT credentials by executing /usr/lib/apt/apt-helper using the download-file command. During this process, the secret bearer token is embedded directly in...

UBUNTU-CVE-2026-12391

An insecure symlink following vulnerability exists in Canonical ubuntu-pro-client formerly ubuntu-advantage-tools within the pro collect-logs command framework. The utility creates or utilizes predictable temporary file paths or user-accessible log directories when gathering diagnostic informatio...