CVE-2026-9494: canonical ubuntu-pro-client (ubuntu-advantage-tools)

Vulnerability summary

CVE-2026-9494 is a medium (CVSS 5.5) vulnerability in canonical ubuntu-pro-client (ubuntu-advantage-tools). EPSS estimates a 0.15% chance of exploitation in the next 30 days, higher than 3.4% of scored vulnerabilities.

Timeline

1. 16-07-2026
   PublishedVulnerability first disclosed.
2. 16-07-2026
   Last modifiedVulnerability information updated.

Description

An information disclosure vulnerability exists in Canonical ubuntu-pro-client (formerly ubuntu-advantage-tools). The client validates Ubuntu Pro APT credentials by executing /usr/lib/apt/apt-helper using the download-file command. During this process, the secret bearer token is embedded directly in the cleartext URL component passed via the command-line arguments (argv), resulting in a URL format such as https://bearer:<token>@esm.ubuntu.com/.../. On systems utilizing a default-mounted /proc file system where process-hiding mitigations (such as hidepid) are disabled, an unprivileged local attacker can monitor system processes and read the sensitive bearer token directly from /proc/cmdline while the helper process is actively running. This leaked token can subsequently be used to gain unauthorized access to the victim's Ubuntu Pro or Expanded Security Maintenance (ESM) repositories.

• CWE-214Invocation of Process Using Visible Sensitive InformationA process is invoked with sensitive command-line arguments, environment variables, or other elements that can be seen by other processes on the operating system.