CVE-2026-9494

An information disclosure vulnerability exists in Canonical ubuntu-pro-client (formerly ubuntu-advantage-tools). The client validates Ubuntu Pro APT credentials by executing /usr/lib/apt/apt-helper using the download-file command. During this process, the secret bearer token is embedded directly in the cleartext URL component passed via the command-line arguments (argv), resulting in a URL format such as https://bearer:<token>@esm.ubuntu.com/.../. On systems utilizing a default-mounted /proc file system where process-hiding mitigations (such as hidepid) are disabled, an unprivileged local attacker can monitor system processes and read the sensitive bearer token directly from /proc/cmdline while the helper process is actively running. This leaked token can subsequently be used to gain unauthorized access to the victim's Ubuntu Pro or Expanded Security Maintenance (ESM) repositories.

• CWE-214

• https://ubuntu.com/security/CVE-2026-9494

Published

Jul 16, 2026

Last Modified

Jul 16, 2026

Status

Undergoing Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-9486A security flaw has been discovered in SourceCodester Studen…4.3
• CVE-2026-9487XML::Sig versions before 0.71 for Perl allow signature wrapp…9.1
• CVE-2026-9489NitroSense 3.x before 3.01.3052 contains Local Privilege Esc…8.5
• CVE-2026-9490A security vulnerability has been identified in Acer Care Ce…5.5
• CVE-2026-9492The MBStorage DRAM lighting control module within Gigabyte C…8.5
• CVE-2026-9493Service Center developed by BankPro E-Service Technology has…7.1
• CVE-2026-9495Versions of the package @koa/router from 14.0.0 and before 1…7.3
• CVE-2026-9496Versions of the package pacote from 11.2.7 and before 21.5.1…7.7
• CVE-2026-9497A flaw has been found in changmingxie tcc-transaction up to …6.3
• CVE-2026-9498A vulnerability has been found in Dromara lamp-cloud up to 5…6.3
• CVE-2026-9499An out-of-bounds read (buffer over-read) vulnerability exist…6.3
• CVE-2026-9500A vulnerability was found in GNU LibreDWG up to 0.14. The af…5.3