CVE-2026-11386
CriticalCVSS 9.0Summary
An input validation vulnerability in ubuntu-pro-client (formerly ubuntu-advantage-tools) allows injection of arbitrary APT repository configurations and installation of malicious packages with root privileges. The issue stems from missing validation of contract server data used to generate APT source files and execute apt-get install commands.
Risk Assessment
An attacker who can spoof or intercept contract server responses (e.g., via compromised internal infrastructure or MITM with a trusted CA) can gain full root-level control over the Ubuntu system. This affects the preinstalled component on Ubuntu Server and default-attached cloud Pro images.
Recommendation
Immediately update the ubuntu-pro-client package to a patched version. Until then, monitor connection integrity to the contract server and restrict trust in external responses.
Original NVD description (English source)
An input validation and injection vulnerability exists in Canonical ubuntu-pro-client (formerly ubuntu-advantage-tools). The client constructs APT source files (such as /etc/apt/sources.list.d/ubuntu-.list or their DEB822 equivalents) using data received directly from the contract server response via the directives.suites[] and directives.aptURL fields. Because the client utilizes Python's str.format() to write these files without performing escaping, validation, or newline character filtering, a malicious or tampered contract response containing embedded newline (\n) characters can successfully inject arbitrary, attacker-controlled deb configuration lines into root-owned APT sources. When combined with the unvalidated additionalPackages[] field—which is passed positionally into a root-executed apt-get install command—an attacker capable of spoofing or manipulating the contract response (e.g., via a compromised internal infrastructure, an intercepted connection utilizing a trusted CA, or local logical bugs) can force the client to fetch and install malicious packages. This ultimately leads to arbitrary code execution with root privileges on the affected system. This component is preinstalled on supported Ubuntu Server releases and auto-attaches by default on cloud provider Ubuntu Pro images.