CVE-2026-11386

Name of the Vulnerable Software and Affected Versions ubuntu-pro-client versions 14.04 through 26.04

Description An input validation and injection issue exists in the ubuntu-pro-client (formerly ubuntu-advantage-tools). The client generates root-owned APT source files using data from the contract server response via the directives.suites[] and directives.aptURL fields. Because the client uses Python's str.format() without proper escaping, validation, or newline character filtering, a tampered response containing newline characters can inject arbitrary deb configuration lines. When combined with the unvalidated additionalPackages[] field, which is passed into a root-executed apt-get install command, an attacker capable of spoofing or manipulating the contract response can force the system to install malicious packages. This leads to arbitrary code execution with root privileges. This component is preinstalled on supported Ubuntu Server releases and auto-attaches by default on cloud provider Ubuntu Pro images.

Recommendations For versions 14.04 through 26.04, run apt update && apt upgrade to apply the latest patches.