CLSA-2026-1785489136 Fix CVE(s): CVE-2026-11386, CVE-2026-12391, CVE-2026-9494

SECURITY UPDATE: Pro bearer token exposed via apt-helper command line - Write APT credentials to a temporary 0600 auth file and pass a credential-free URL to apt-helper, instead of embedding the token in the download-file URL argument where it leaked to local users via /proc//cmdline. Source...

EUVD-2026-44911

An input validation and injection vulnerability exists in Canonical ubuntu-pro-client formerly ubuntu-advantage-tools. The client constructs APT source files such as /etc/apt/sources.list.d/ubuntu-.list or their DEB822 equivalents using data received directly from the contract server response via...

CVE-2026-11386

Summary: CVE-2026-11386 affects Canonical ubuntu-pro-client (formerly ubuntu-advantage-tools). The package builds APT source files by interpolating contract server data from directives.suites[] and directives.aptURL without escaping or validation, allowing newline characters to inject attacker-co...