CVE-2026-11386

An input validation and injection vulnerability exists in Canonical ubuntu-pro-client (formerly ubuntu-advantage-tools). The client constructs APT source files (such as /etc/apt/sources.list.d/ubuntu-.list or their DEB822 equivalents) using data received directly from the contract server response via the directives.suites[] and directives.aptURL fields. Because the client utilizes Python's str.format() to write these files without performing escaping, validation, or newline character filtering, a malicious or tampered contract response containing embedded newline (\n) characters can successfully inject arbitrary, attacker-controlled deb configuration lines into root-owned APT sources. When combined with the unvalidated additionalPackages[] field—which is passed positionally into a root-executed apt-get install command—an attacker capable of spoofing or manipulating the contract response (e.g., via a compromised internal infrastructure, an intercepted connection utilizing a trusted CA, or local logical bugs) can force the client to fetch and install malicious packages. This ultimately leads to arbitrary code execution with root privileges on the affected system. This component is preinstalled on supported Ubuntu Server releases and auto-attaches by default on cloud provider Ubuntu Pro images.

• CWE-20

• https://ubuntu.com/security/CVE-2026-11386

Published

Jul 16, 2026

Last Modified

Jul 16, 2026

Status

Undergoing Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-113844Improper access control in Windows NTFS allows an authorized…5.5
• CVE-2026-113847Integer overflow or wraparound in Windows Installer allows a…7.8
• CVE-2026-113848Null pointer dereference in Windows NTFS allows an unauthori…7.8
• CVE-2026-113855Use of uninitialized resource in Windows DNS allows an unaut…7.5
• CVE-2026-113856Heap-based buffer overflow in Windows Hyper-V allows an auth…7.8
• CVE-2026-113859Use after free in Windows TCP/IP allows an unauthorized atta…7.5
• CVE-2026-113860Use after free in Windows Hyper-V allows an authorized attac…7
• CVE-2026-113861Use after free in Windows Hyper-V allows an authorized attac…7.5
• CVE-2026-113862Use after free in Windows Network Address Translation (NAT) …8.1
• CVE-2026-113863Heap-based buffer overflow in Windows DHCP Client allows an …8.8
• CVE-2026-113864Use after free in Windows Hyper-V allows an authorized attac…6.4
• CVE-2026-113865Time-of-check time-of-use (toctou) race condition in Windows…7.8