Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-9494— ubuntu-pro-client Information Disclosure via Cleartext Bearer Token Exposure in Process Command Line

CVSS 5.5 · Medium EPSS 0.10% · P1

Affected Version Matrix 8

VendorProductVersion RangeStatus
CanonicalUbuntu 14.04 LTS19.7ubuntu0.1unaffected
CanonicalUbuntu 16.04 LTS37.1ubuntu0~16.04.1unaffected
CanonicalUbuntu 18.04 LTS37.1ubuntu0~18.04.1unaffected
CanonicalUbuntu 20.04 LTS37.1ubuntu0~20.04.1unaffected
CanonicalUbuntu 22.04 LTS37.2ubuntu~22.04.1unaffected
CanonicalUbuntu 24.04 LTS37.2ubuntu~24.04.1unaffected
CanonicalUbuntu 26.04 LTS37.2ubuntu0.1unaffected
Canonicalubuntu-pro-client (ubuntu-advantage-tools)< 37.3affected
Get alerts for future matching vulnerabilitiesLog in to subscribe

I. Basic Information for CVE-2026-9494

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
ubuntu-pro-client Information Disclosure via Cleartext Bearer Token Exposure in Process Command Line
Source: NVD (National Vulnerability Database)
Vulnerability Description
An information disclosure vulnerability exists in Canonical ubuntu-pro-client (formerly ubuntu-advantage-tools). The client validates Ubuntu Pro APT credentials by executing /usr/lib/apt/apt-helper using the download-file command. During this process, the secret bearer token is embedded directly in the cleartext URL component passed via the command-line arguments (argv), resulting in a URL format such as https://bearer:<token>@esm.ubuntu.com/.../. On systems utilizing a default-mounted /proc file system where process-hiding mitigations (such as hidepid) are disabled, an unprivileged local attacker can monitor system processes and read the sensitive bearer token directly from /proc/cmdline while the helper process is actively running. This leaked token can subsequently be used to gain unauthorized access to the victim's Ubuntu Pro or Expanded Security Maintenance (ESM) repositories.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Source: NVD (National Vulnerability Database)
Vulnerability Type
通过处理环境导致的信息暴露
Source: NVD (National Vulnerability Database)
Vulnerability Title
Canonical ubuntu-advantage-tools 信息泄露漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Canonical ubuntu-advantage-tools是英国Canonical公司的一款系统管理工具套件。 Canonical ubuntu-advantage-tools 37.3之前版本存在信息泄露漏洞，该漏洞源于客户端执行/usr/lib/apt/apt-helper使用download-file命令时，将秘密bearer令牌直接嵌入到通过命令行参数传递的明文URL组件中，在系统使用默认挂载的/proc文件系统且未启用进程隐藏缓解措施时，本地非特权攻击者可监控系统进程并从/proc/cmd
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

VendorProductAffected VersionsCPESubscribe
Canonicalubuntu-pro-client (ubuntu-advantage-tools) 0 ~ 37.3 -
CanonicalUbuntu 26.04 LTS 37.2ubuntu0.1 -
CanonicalUbuntu 24.04 LTS 37.2ubuntu~24.04.1 -
CanonicalUbuntu 22.04 LTS 37.2ubuntu~22.04.1 -
CanonicalUbuntu 20.04 LTS 37.1ubuntu0~20.04.1 -
CanonicalUbuntu 18.04 LTS 37.1ubuntu0~18.04.1 -
CanonicalUbuntu 16.04 LTS 37.1ubuntu0~16.04.1 -
CanonicalUbuntu 14.04 LTS 19.7ubuntu0.1 -

II. Public POCs for CVE-2026-9494

#POC DescriptionSource LinkShenlong Link
AI-Generated POCPremium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-9494

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-9494 (1)

Same Patch Batch · Canonical · 2026-07-16 · 3 CVEs total

CVE-2026-113869.0 CRITICALubuntu-pro-client Input Validation Vulnerability Leading to Arbitrary APT Directive Inject
CVE-2026-123915.0 MEDIUMubuntu-pro-client Local Privilege Escalation and Information Disclosure via Symlink Arbitr

IV. Related Vulnerabilities

Same product: ubuntu-pro-client (ubuntu-advantage-tools)
Same vendor: Canonical
Same weakness: CWE-214

V. Comments for CVE-2026-9494

No comments yet

Leave a comment