CVE-2026-9494

{"id": "CVE-2026-9494", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-9494", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-16T13:36:06.361605Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security@ubuntu.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 1.8}]}, "affected": [{"source": "security@ubuntu.com", "affectedData": [{"repo": "https://github.com/canonical/ubuntu-pro-client", "vendor": "Canonical", "product": "ubuntu-pro-client (ubuntu-advantage-tools)", "versions": [{"status": "affected", "version": "0", "lessThan": "37.3", "versionType": "python"}], "platforms": ["Linux"], "packageName": "ubuntu-pro-client", "collectionURL": "https://github.com/canonical/", "defaultStatus": "unaffected"}, {"repo": "https://launchpad.net/ubuntu/+source/ubuntu-advantage-tools", "vendor": "Canonical", "product": "Ubuntu 26.04 LTS", "versions": [{"status": "unaffected", "version": "37.2ubuntu0.1", "versionType": "dpkg"}], "platforms": ["Linux"], "packageName": "ubuntu-advantage-tools", "collectionURL": "https://launchpad.net/ubuntu/resolute", "defaultStatus": "affected"}, {"repo": "https://launchpad.net/ubuntu/+source/ubuntu-advantage-tools", "vendor": "Canonical", "product": "Ubuntu 24.04 LTS", "versions": [{"status": "unaffected", "version": "37.2ubuntu~24.04.1", "versionType": "dpkg"}], "platforms": ["Linux"], "packageName": "ubuntu-advantage-tools", "collectionURL": "https://launchpad.net/ubuntu/noble", "defaultStatus": "affected"}, {"repo": "https://launchpad.net/ubuntu/+source/ubuntu-advantage-tools", "vendor": "Canonical", "product": "Ubuntu 22.04 LTS", "versions": [{"status": "unaffected", "version": "37.2ubuntu~22.04.1", "versionType": "dpkg"}], "platforms": ["Linux"], "packageName": "ubuntu-advantage-tools", "collectionURL": "https://launchpad.net/ubuntu/jammy", "defaultStatus": "affected"}, {"repo": "https://launchpad.net/ubuntu/+source/ubuntu-advantage-tools", "vendor": "Canonical", "product": "Ubuntu 20.04 LTS", "versions": [{"status": "unaffected", "version": "37.1ubuntu0~20.04.1", "versionType": "dpkg"}], "platforms": ["Linux"], "packageName": "ubuntu-advantage-tools", "collectionURL": "https://launchpad.net/ubuntu/focal", "defaultStatus": "affected"}, {"repo": "https://launchpad.net/ubuntu/+source/ubuntu-advantage-tools", "vendor": "Canonical", "product": "Ubuntu 18.04 LTS", "versions": [{"status": "unaffected", "version": "37.1ubuntu0~18.04.1", "versionType": "dpkg"}], "platforms": ["Linux"], "packageName": "ubuntu-advantage-tools", "collectionURL": "https://launchpad.net/ubuntu/bionic", "defaultStatus": "affected"}, {"repo": "https://launchpad.net/ubuntu/+source/ubuntu-advantage-tools", "vendor": "Canonical", "product": "Ubuntu 16.04 LTS", "versions": [{"status": "unaffected", "version": "37.1ubuntu0~16.04.1", "versionType": "dpkg"}], "platforms": ["Linux"], "packageName": "ubuntu-advantage-tools", "collectionURL": "https://launchpad.net/ubuntu/xenial", "defaultStatus": "affected"}, {"repo": "https://launchpad.net/ubuntu/+source/ubuntu-advantage-tools", "vendor": "Canonical", "product": "Ubuntu 14.04 LTS", "versions": [{"status": "unaffected", "version": "19.7ubuntu0.1", "versionType": "dpkg"}], "platforms": ["Linux"], "packageName": "ubuntu-advantage-tools", "collectionURL": "https://launchpad.net/ubuntu/trusty", "defaultStatus": "affected"}]}], "published": "2026-07-16T13:16:34.520", "references": [{"url": "https://ubuntu.com/security/CVE-2026-9494", "source": "security@ubuntu.com"}], "vulnStatus": "Undergoing Analysis", "weaknesses": [{"type": "Secondary", "source": "security@ubuntu.com", "description": [{"lang": "en", "value": "CWE-214"}]}], "descriptions": [{"lang": "en", "value": "An information disclosure vulnerability exists in Canonical ubuntu-pro-client (formerly ubuntu-advantage-tools). The client validates Ubuntu Pro APT credentials by executing /usr/lib/apt/apt-helper using the download-file command. During this process, the secret bearer token is embedded directly in\nthe cleartext URL component passed via the command-line arguments (argv), resulting in a URL format such as https://bearer:<token>@esm.ubuntu.com/.../. On systems utilizing a default-mounted /proc file system where process-hiding mitigations (such as hidepid) are disabled, an unprivileged local attacker can\nmonitor system processes and read the sensitive bearer token directly from /proc/cmdline while the helper process is actively running. This leaked token can subsequently be used to gain unauthorized access to the victim's Ubuntu Pro or Expanded Security Maintenance (ESM) repositories."}], "lastModified": "2026-07-16T16:19:16.463", "sourceIdentifier": "security@ubuntu.com"}