CVE-2026-9494
Publication date 17 July 2026
Last updated 16 July 2026
Ubuntu priority
Description
An information disclosure vulnerability exists in Canonical ubuntu-pro-client (formerly ubuntu-advantage-tools). The client validates Ubuntu Pro APT credentials by executing /usr/lib/apt/apt-helper using the download-file command. During this process, the secret bearer token is embedded directly in the cleartext URL component passed via the command-line arguments (argv), resulting in a URL format such as https://bearer:<token>@esm.ubuntu.com/.../. On systems utilizing a default-mounted /proc file system where process-hiding mitigations (such as hidepid) are disabled, an unprivileged local attacker can monitor system processes and read the sensitive bearer token directly from /proc/<pid>/cmdline while the helper process is actively running. This leaked token can subsequently be used to gain unauthorized access to the victim's Ubuntu Pro or Expanded Security Maintenance (ESM) repositories.
Status
| Package | Ubuntu Release | Status |
|---|---|---|
| ubuntu-advantage-tools | 26.04 LTS resolute |
Fixed 37.2ubuntu0.1
|
| 24.04 LTS noble |
Fixed 37.2ubuntu~24.04.1
|
|
| 22.04 LTS jammy |
Fixed 37.2ubuntu~22.04.1
|
|
| 20.04 LTS focal |
Fixed 37.1ubuntu0~20.04.1
|
|
| 18.04 LTS bionic |
Fixed 37.1ubuntu0~18.04.1
|
|
| 16.04 LTS xenial |
Fixed 37.1ubuntu0~16.04.1
|
|
| 14.04 LTS trusty |
Fixed 19.7ubuntu0.1
|
Get expanded security coverage with Ubuntu Pro
Reduce your average CVE exposure time from 98 days to 1 day with expanded CVE patching, ten-years security maintenance and optional support for the full stack of open-source applications. Free for personal use.
Get Ubuntu Pro 30-day free trialSeverity score breakdown
CVSS version: CVSS v3.0
Base score
5.5 · Medium
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
References
Related Ubuntu Security Notices (USN)
- USN-8555-1
- Ubuntu Advantage Tools (pro client) vulnerabilities
- 16 July 2026