# Critical Ubuntu Pro Client Vulnerability Enables Root Code Execution via Contract Server Spoofing (CVE-2026-11386)

> CVE-2026-11386 (CVSS 9.0) is an improper-input-validation flaw in Canonical's Ubuntu Pro Client (ubuntu-advantage-tools) that allows a spoofed or tampered contract-server response to inject arbitrary APT source directives via unescaped newline characters, leading to root-level arbitrary code execution across all Ubuntu LTS releases 14.04 through 26.04, with Ubuntu 25.10 left unpatched at disclosure.

- **Published:** 2026-07-20T00:00:00Z
- **Last reviewed:** 2026-07-20T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1564
- **ID:** TL-2026-1564
- **Severity:** CRITICAL (CVSS 9)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 15 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-11386, CVE-2026-9494, CVE-2026-12391

## Description

Canonical's Ubuntu Pro Client (formerly ubuntu-advantage-tools) periodically contacts Canonical's contract server to retrieve entitlement and repository-configuration directives, then writes those directives into local APT source files (.sources / .list) so the system can pull packages from Ubuntu Pro-gated repositories (esm-apps, esm-infra, FIPS, Livepatch, etc.). CVE-2026-11386 arises because the client constructs these APT source files by interpolating two contract-server-supplied fields -- directives.suites[] and directives.aptURL -- using Python's str.format() with no output escaping and no newline filtering. An attacker who can present a malicious or tampered contract-server response (via compromised internal proxy/mirror infrastructure, a man-in-the-middle position holding a trusted certificate, DNS/routing manipulation toward an attacker-controlled endpoint impersonating the contract server, or compromise of the contract-server backend itself) can embed newline characters inside these fields. Because the values are written unescaped into the APT sources file, embedded newlines terminate the intended directive line and inject an entirely new, attacker-controlled APT configuration stanza -- for example a rogue deb line pointing at an attacker-controlled repository, or directives that disable signature verification for a repo. A companion flaw in the same code path allows the unvalidated additionalPackages[] field returned by the contract server to be passed directly into a root-executed `apt-get install` invocation, allowing arbitrary package installation as root without requiring the attacker to control a full repository. Because `pro attach`, `pro auto-attach`, systemd timers, and cloud-init Ubuntu Pro integrations all invoke the Ubuntu Pro Client's contract-refresh logic as root (uid 0) and typically on a schedule (daily/periodic checks) with no interactive confirmation, a single successful spoofed response converts into unattended, unauthenticated root code execution the next time `apt update`/`apt upgrade`/`unattended-upgrades` processes the injected repository. This makes the flaw particularly severe for cloud workloads that auto-attach Ubuntu Pro entitlements via cloud-init/metadata services and for enterprises that route Ubuntu Pro Client contract traffic through internal proxies or mirrors, since compromise of that intermediary (rather than Canonical's servers) is sufficient to trigger the chain. The vulnerability is tracked alongside two related but functionally distinct issues fixed in the same Ubuntu Security Notice: CVE-2026-9494 (Pro bearer token exposure via command-line arguments during APT credential validation, allowing a local attacker to harvest the token and gain unauthorized repository access) and CVE-2026-12391 (improper symlink handling during Ubuntu Pro Client diagnostic log collection, allowing a local attacker to read sensitive administrator-owned files). All three were addressed together in USN-8555-1. As of publication (2026-07-20) there is no public proof-of-concept exploit and no confirmed in-the-wild exploitation, and the CVE is not present in the CISA Known Exploited Vulnerabilities catalog; however the combination of root-level impact, network attack vector, unattended/scheduled trigger, and the enormous installed base of Ubuntu LTS (14.04-26.04) across cloud and enterprise fleets makes this a high-priority patch-now advisory.

## MITRE ATT&CK

- T1195 Supply Chain Compromise
- T1557 Adversary-in-the-Middle
- T1190 Exploit Public-Facing Application
- T1059 Command and Scripting Interpreter
- T1053 Scheduled Task/Job
- T1072 Software Deployment Tools
- T1505 Server Software Component
- T1195 Supply Chain Compromise
- T1547 Boot or Logon Autostart Execution
- T1068 Exploitation for Privilege Escalation
- T1053 Scheduled Task/Job
- T1218 System Binary Proxy Execution
- T1685 Disable or Modify Tools
- T1199 Trusted Relationship
- T1552 Unsecured Credentials
- T1557 Adversary-in-the-Middle
- T1083 File and Directory Discovery
- T1082 System Information Discovery
- T1005 Data from Local System
- T1090 Proxy
- T1529 System Shutdown/Reboot

## Sources

- [Critical Ubuntu Pro Client Vulnerability Enables Root Code Execution Across Cloud Workloads](https://orca.security/resources/blog/ubuntu-pro-client-vulnerability-cve-2026-11386/)
- [CVE-2026-11386 Detail](https://nvd.nist.gov/vuln/detail/CVE-2026-11386)
- [USN-8555-1: Ubuntu Advantage Tools (pro client) vulnerabilities](https://ubuntu.com/security/notices/USN-8555-1)
- [CVE-2026-11386 | Ubuntu](https://ubuntu.com/security/CVE-2026-11386)
- [How to resolve a specific CVE or USN - Ubuntu Pro Client documentation](https://documentation.ubuntu.com/pro-client/en/latest/howtoguides/fix_how_to_resolve_given_cve/)
- [CISA Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1564