CLSA-2026-1785489136 Fix CVE(s): CVE-2026-11386, CVE-2026-12391, CVE-2026-9494

SECURITY UPDATE: Pro bearer token exposed via apt-helper command line - Write APT credentials to a temporary 0600 auth file and pass a credential-free URL to apt-helper, instead of embedding the token in the download-file URL argument where it leaked to local users via /proc//cmdline. Source...

CVE-2026-11386

An input validation and injection vulnerability exists in Canonical ubuntu-pro-client formerly ubuntu-advantage-tools. The client constructs APT source files such as /etc/apt/sources.list.d/ubuntu-.list or their DEB822 equivalents using data received directly from the contract server response via...

CVE-2026-11386: Improper Input Validation

An input validation and injection vulnerability exists in Canonical ubuntu-pro-client formerly ubuntu-advantage-tools. The client constructs APT source files such as /etc/apt/sources.list.d/ubuntu-.list or their DEB822 equivalents using data received directly from the contract server response via...