Critical Ubuntu Pro Client Vulnerability Enables Root Code Execution via Contract Server Spoofing (CVE-2026-11386)

Critical Ubuntu Pro Client Vulnerability Enables Root Code (TL-2026-1564), also tracked as Ubuntu Pro Client Contract Server Spoofing RCE, is a critical-severity software vulnerability scored CVSS 9, first published 2026-07-20. It has no confirmed attribution, affects Canonical ubuntu-advantage-tools / ubuntu-pro-client, references 3 CVEs (CVE-2026-11386, CVE-2026-9494, CVE-2026-12391), maps to 18 MITRE ATT&CK techniques (T1005, T1053, T1059), and is covered by 9 detection rules and 15 indicators of compromise.

Key facts for TL-2026-1564

Threat ID
TL-2026-1564
Also known as
Ubuntu Pro Client Contract Server Spoofing RCE, USN-8555-1 APT Source Injection
Severity
CRITICAL
CVSS
9 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H)
Status
ACTIVE
Category
VULNERABILITY
First published
2026-07-20
Last reviewed
2026-07-20
Attribution confidence
LOW
Motivation
UNKNOWN
Target sectors
technology, cloudhosting, government administration, finance, health, telecoms, managedserviceproviders, education, manufacturing
Target regions
Global
Detection rules
9
Indicators of compromise
15

CVE-2026-11386 (CVSS 9.0) is an improper-input-validation flaw in Canonical's Ubuntu Pro Client (ubuntu-advantage-tools) that allows a spoofed or tampered contract-server response to inject arbitrary APT source directives via unescaped newline characters, leading to root-level arbitrary code execution across all Ubuntu LTS releases 14.04 through 26.04, with Ubuntu 25.10 left unpatched at disclosure.

How Critical Ubuntu Pro Client Vulnerability Enables Root Code works

Canonical's Ubuntu Pro Client (formerly ubuntu-advantage-tools) periodically contacts Canonical's contract server to retrieve entitlement and repository-configuration directives, then writes those directives into local APT source files (.sources / .list) so the system can pull packages from Ubuntu Pro-gated repositories (esm-apps, esm-infra, FIPS, Livepatch, etc.). CVE-2026-11386 arises because the client constructs these APT source files by interpolating two contract-server-supplied fields -- directives.suites[] and directives.aptURL -- using Python's str.format() with no output escaping and no newline filtering. An attacker who can present a malicious or tampered contract-server response (via compromised internal proxy/mirror infrastructure, a man-in-the-middle position holding a trusted certificate, DNS/routing manipulation toward an attacker-controlled endpoint impersonating the contract server, or compromise of the contract-server backend itself) can embed newline characters inside these fields. Because the values are written unescaped into the APT sources file, embedded newlines terminate the intended directive line and inject an entirely new, attacker-controlled APT configuration stanza -- for example a rogue deb line pointing at an attacker-controlled repository, or directives that disable signature verification for a repo. A companion flaw in the same code path allows the unvalidated additionalPackages[] field returned by the contract server to be passed directly into a root-executed `apt-get install` invocation, allowing arbitrary package installation as root without requiring the attacker to control a full repository. Because `pro attach`, `pro auto-attach`, systemd timers, and cloud-init Ubuntu Pro integrations all invoke the Ubuntu Pro Client's contract-refresh logic as root (uid 0) and typically on a schedule (daily/periodic checks) with no interactive confirmation, a single successful spoofed response converts into unattended, unauthenticated root code execution the next time `apt update`/`apt upgrade`/`unattended-upgrades` processes the injected repository. This makes the flaw particularly severe for cloud workloads that auto-attach Ubuntu Pro entitlements via cloud-init/metadata services and for enterprises that route Ubuntu Pro Client contract traffic through internal proxies or mirrors, since compromise of that intermediary (rather than Canonical's servers) is sufficient to trigger the chain. The vulnerability is tracked alongside two related but functionally distinct issues fixed in the same Ubuntu Security Notice: CVE-2026-9494 (Pro bearer token exposure via command-line arguments during APT credential validation, allowing a local attacker to harvest the token and gain unauthorized repository access) and CVE-2026-12391 (improper symlink handling during Ubuntu Pro Client diagnostic log collection, allowing a local attacker to read sensitive administrator-owned files). All three were addressed together in USN-8555-1. As of publication (2026-07-20) there is no public proof-of-concept exploit and no confirmed in-the-wild exploitation, and the CVE is not present in the CISA Known Exploited Vulnerabilities catalog; however the combination of root-level impact, network attack vector, unattended/scheduled trigger, and the enormous installed base of Ubuntu LTS (14.04-26.04) across cloud and enterprise fleets makes this a high-priority patch-now advisory.

MITRE ATT&CK techniques used in TL-2026-1564

Collection

T1005 Data from Local System

Execution

T1053 Scheduled Task/Job; T1059 Command and Scripting Interpreter; T1072 Software Deployment Tools

Privilege Escalation

T1053 Scheduled Task/Job; T1068 Exploitation for Privilege Escalation

Discovery

T1082 System Information Discovery; T1083 File and Directory Discovery

Command and Control

T1090 Proxy

Initial Access

T1190 Exploit Public-Facing Application; T1195 Supply Chain Compromise

initial-access

T1195 Supply Chain Compromise; T1199 Trusted Relationship

Defense Evasion

T1218 System Binary Proxy Execution

Persistence

T1505 Server Software Component; T1547 Boot or Logon Autostart Execution

Impact

T1529 System Shutdown/Reboot

Credential Access

T1552 Unsecured Credentials; T1557 Adversary-in-the-Middle

credential-access

T1557 Adversary-in-the-Middle

defense-impairment

T1685 Disable or Modify Tools

Affected products and versions in Critical Ubuntu Pro Client Vulnerability Enables Root Code

  • Canonical — ubuntu-advantage-tools / ubuntu-pro-client
    Vulnerable versions: Ubuntu 14.04 LTS (Trusty); Ubuntu 16.04 LTS (Xenial); Ubuntu 18.04 LTS (Bionic); Ubuntu 20.04 LTS (Focal); Ubuntu 22.04 LTS (Jammy); Ubuntu 24.04 LTS (Noble); Ubuntu 25.10 (Questing) -- unpatched at disclosure; Ubuntu 26.04 LTS; ubuntu-pro-client < 37.3
    Fixed in: Ubuntu 26.04 LTS with ubuntu-advantage-tools 37.2ubuntu0.1; Ubuntu 24.04 LTS with 37.2ubuntu~24.04.1; Ubuntu 22.04 LTS with 37.2ubuntu~22.04.1; Ubuntu 20.04 LTS with 37.1ubuntu0~20.04.1; Ubuntu 18.04 LTS with 37.1ubuntu0~18.04.1; Ubuntu 16.04 LTS with 37.1ubuntu0~16.04.1; Ubuntu 14.04 LTS with 19.7ubuntu0.1 (Legacy Support)

Remediation for Critical Ubuntu Pro Client Vulnerability Enables Root Code

Patches

  • Ubuntu 26.04 LTS: ubuntu-advantage-tools/ubuntu-pro-client 37.2ubuntu0.1
  • Ubuntu 24.04 LTS: 37.2ubuntu~24.04.1
  • Ubuntu 22.04 LTS: 37.2ubuntu~22.04.1
  • Ubuntu 20.04 LTS: 37.1ubuntu0~20.04.1
  • Ubuntu 18.04 LTS: 37.1ubuntu0~18.04.1
  • Ubuntu 16.04 LTS: 37.1ubuntu0~16.04.1
  • Ubuntu 14.04 LTS: 19.7ubuntu0.1 (requires Ubuntu Pro with Legacy Support)
  • Fixed upstream in ubuntu-pro-client >= 37.3
  • Ubuntu 25.10 unpatched at time of publication -- treat as unsupported/high-risk until Canonical ships a fix

Immediate actions

  • Run `apt update && apt upgrade` on all Ubuntu hosts running ubuntu-advantage-tools / ubuntu-pro-client to pull the patched package version for your release.
  • Audit APT source files (/etc/apt/sources.list, /etc/apt/sources.list.d/*.sources, /etc/apt/sources.list.d/*.list) for unexpected or malformed entries, embedded newlines, or repository URLs that do not match Canonical's known Ubuntu Pro/ESM endpoints.
  • Restrict and monitor network egress from Ubuntu Pro Client hosts to the contract server (contracts.canonical.com) and enforce TLS certificate pinning/validation on any internal proxy or mirror that intermediates this traffic.
  • Review recent `apt-get install` invocations triggered by `pro` / `ua` daemons or systemd timers (ua-timer.service, apt-daily.service interplay) for unexpected packages.
  • Rotate and audit any Ubuntu Pro bearer tokens potentially exposed via process command-line arguments (CVE-2026-9494) on affected hosts.
  • Disable Ubuntu Pro auto-attach in cloud-init user-data for fleets that cannot patch immediately, until the contract-refresh path is confirmed patched.

Workarounds

  • No official workaround exists for unpatched systems; Canonical/Orca advise patching as the only reliable mitigation.
  • As an interim compensating control, restrict outbound access from hosts to the legitimate Canonical contract-server IP ranges/hostname only, and block/alert on any TLS interception of that traffic at internal proxies.

Longer-term hardening

  • Deploy file-integrity monitoring (FIM) on /etc/apt/sources.list* to alert on unauthorized modification.
  • Segment and authenticate internal APT mirror/proxy infrastructure that Ubuntu Pro Client traffic transits, since compromise of that intermediary is a viable attack path even without breaching Canonical.
  • Adopt configuration-management enforcement (e.g. Ansible/Puppet/Chef desired-state checks) that reverts unexpected APT source entries.
  • Track Canonical Ubuntu Security Notices (USNs) for ubuntu-advantage-tools/ubuntu-pro-client and apply patches on a regular cadence given the tool's root-privileged, network-facing update logic.

CVEs associated with Critical Ubuntu Pro Client Vulnerability Enables Root Code

CVE-2026-11386, CVE-2026-9494, CVE-2026-12391

Weaknesses (CWE) in Critical Ubuntu Pro Client Vulnerability Enables Root Code

CWE-20, CWE-88, CWE-93, CWE-59

Timeline of Critical Ubuntu Pro Client Vulnerability Enables Root Code

  • USN-8555-1 clarifies that CVE-2026-12391 (symlink diagnostic-log flaw) affects only Ubuntu 16.04 LTS through 26.04 LTS, narrower than the 14.04-26.04 scope of the primary CVE-2026-11386 contract-server injection flaw.
  • USN-8555-1 credits three separate researchers for the coordinated disclosure: Frederick Jerusha for CVE-2026-11386 (APT source injection RCE), Bilal Teke for CVE-2026-9494 (Pro bearer token exposure), and Mateusz Gierblinski for CVE-2026-12391 (symlink handling in diagnostic log collection).
  • Canonical publishes USN-8555-1 covering CVE-2026-11386 (APT source injection RCE), CVE-2026-9494 (Pro bearer token exposure), and CVE-2026-12391 (symlink handling in log collection), with patched ubuntu-advantage-tools/ubuntu-pro-client versions for Ubuntu 14.04 through 26.04 LTS.
  • CVE-2026-11386 published to NVD with CVSS 3.1 base score 9.0 (Critical); CWE-20 Improper Input Validation assigned.
  • Threadlinqs Intelligence Platform establishes ongoing monitoring of the CISA KEV catalog and public exploit-code repositories (GitHub, ExploitDB) for CVE-2026-11386 given its unauthenticated root-RCE profile and large unpatched Ubuntu 25.10 exposure window.
  • Threadlinqs Intelligence Platform ingests the Orca Security disclosure and opens threat record TL-2026-1564 for tracking and detection engineering.
  • CVE-2026-11386 confirmed absent from the CISA Known Exploited Vulnerabilities (KEV) catalog as of publication date.
  • No public proof-of-concept exploit code identified on GitHub or security research repositories; no confirmed in-the-wild exploitation reported.
  • Public disclosure confirms Ubuntu 25.10 remains unpatched at time of publication, leaving that release exposed with no available fix.
  • Orca Security Research Pod publishes independent technical blog analysis detailing the contract-server spoofing exploit chain, the unescaped str.format() injection into APT source files, and the unvalidated additionalPackages[] root apt-get install vector.

Sources cited for Critical Ubuntu Pro Client Vulnerability Enables Root Code

Threats related to Critical Ubuntu Pro Client Vulnerability Enables Root Code

Detection coverage for TL-2026-1564

As of 2026-07-20, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1564 across Splunk SPL, Microsoft KQL and Sigma, covering 15 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats