# CVE-2026-102371: wsl-pro-service command-line token disclosure

Source: https://junglewise.ai/threats/cve-2026-102371-in-wsl-pro-service-before-0-1-19ubuntu3-the-service-component  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-29. Updated: 2026-09-29  
License: CC BY 4.0 with a link back

CVE-2026-102371 · Severity: info · Published 2026-09-29

The wsl-pro-service component in Ubuntu Pro for WSL passes authentication tokens to the Ubuntu Pro client via command-line arguments, which are readable by unprivileged users through /proc on systems without process hiding protections. An attacker could read the token from process arguments and use it to attach unauthorized machines to a victim's Ubuntu Pro subscription, gaining access to restricted services and resources.

Vendors: [Canonical](https://junglewise.ai/threats/vendors/canonical).

## Quick answers

**Is CVE-2026-102371 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-102371 being exploited in the wild.

**How severe is CVE-2026-102371?** Informational severity, published 29 September 2026.

**Which products and versions are affected?** Canonical Wsl-Pro-Service before 0.1.19ubuntu3.

**Is there a fix for CVE-2026-102371?** A patch was published on 2026-09-17: Token passed via ephemeral config file instead of CLI argument Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-102371 attacked?** It is attacked with local access.

**Am I affected by CVE-2026-102371?** Check whether you run Canonical Wsl-Pro-Service at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The service passes the Ubuntu Pro token as a CLI argument to the pro attach command (pro attach <token>), exposing it in /proc/<pid>/cmdline. This affects systems without /proc hidepid mitigations, which is the default in WSL. A local unprivileged attacker can read the token while the attach process runs and reuse it to attach other systems to the victim's Ubuntu Pro account.

## Affected products

- Canonical wsl-pro-service before 0.1.19ubuntu3

## Timeline

- 2026-09-29: disclosed
- 2026-09-17: patched: Token passed via ephemeral config file instead of CLI argument

## References

- [https://github.com/canonical/ubuntu-pro-for-wsl/commit/11c164a37b806bcf2a2304beb0d65e406739778b](https://github.com/canonical/ubuntu-pro-for-wsl/commit/11c164a37b806bcf2a2304beb0d65e406739778b)
- [https://github.com/canonical/ubuntu-pro-for-wsl/pull/1816](https://github.com/canonical/ubuntu-pro-for-wsl/pull/1816)