the cleartext URL component passed via the command-line arguments (argv), resulting in a URL format such as https://bearer:<token>@esm.ubuntu.com/.../. On systems utilizing a default-mounted /proc file system where process-hiding mitigations (such as hidepid) are disabled, an unprivileged local attacker can
monitor system processes and read the sensitive bearer token directly from /proc/cmdline while the helper process is actively running. This leaked token can subsequently be used to gain unauthorized access to the victim's Ubuntu Pro or Expanded Security Maintenance (ESM) repositories.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| Canonical | ubuntu-pro-client (ubuntu-advantage-tools) | unaffected |
|
||||||
| Canonical | Ubuntu 26.04 LTS | affected |
|
||||||
| Canonical | Ubuntu 24.04 LTS | affected |
|
||||||
| Canonical | Ubuntu 22.04 LTS | affected |
|
||||||
| Canonical | Ubuntu 20.04 LTS | affected |
|
||||||
| Canonical | Ubuntu 18.04 LTS | affected |
|
||||||
| Canonical | Ubuntu 16.04 LTS | affected |
|
||||||
| Canonical | Ubuntu 14.04 LTS | affected |
|
No data.
No data.
OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.
| Vendors | Products |
|---|---|
|
Canonical
Subscribe
|
Project Subscriptions
| Source | ID | Title |
|---|---|---|
 Ubuntu USN |
USN-8555-1 | Ubuntu Advantage Tools (pro client) vulnerabilities |
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
| Link | Providers |
|---|---|
| https://ubuntu.com/security/CVE-2026-9494 |
|
Thu, 23 Jul 2026 22:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Canonical
Canonical ubuntu Canonical ubuntu-pro-client |
|
| Vendors & Products |
Canonical
Canonical ubuntu Canonical ubuntu-pro-client |
Thu, 16 Jul 2026 16:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
ssvc
|
Thu, 16 Jul 2026 13:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | An information disclosure vulnerability exists in Canonical ubuntu-pro-client (formerly ubuntu-advantage-tools). The client validates Ubuntu Pro APT credentials by executing /usr/lib/apt/apt-helper using the download-file command. During this process, the secret bearer token is embedded directly in the cleartext URL component passed via the command-line arguments (argv), resulting in a URL format such as https://bearer:<token>@esm.ubuntu.com/.../. On systems utilizing a default-mounted /proc file system where process-hiding mitigations (such as hidepid) are disabled, an unprivileged local attacker can monitor system processes and read the sensitive bearer token directly from /proc/cmdline while the helper process is actively running. This leaked token can subsequently be used to gain unauthorized access to the victim's Ubuntu Pro or Expanded Security Maintenance (ESM) repositories. | |
| Title | ubuntu-pro-client Information Disclosure via Cleartext Bearer Token Exposure in Process Command Line | |
| Weaknesses | CWE-214 | |
| References |
| |
| Metrics |
cvssV3_1
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: canonical
Published:
Updated: 2026-07-16T15:11:07.229Z
Reserved: 2026-05-25T08:23:24.573Z
Link: CVE-2026-9494
Vulnrichment
Updated: 2026-07-16T13:36:11.538Z
NVD
Status : Awaiting Analysis
Published: 2026-07-16T13:16:34.520
Modified: 2026-07-16T16:19:16.463
Link: CVE-2026-9494
Redhat
No data.
OpenCVE Enrichment
Updated: 2026-07-31T02:15:06Z