Executive brief
A vulnerability in the Ubuntu Pro client, a tool preinstalled on Ubuntu Server and cloud images, could allow an attacker to take full control of a system. By manipulating the data sent from a contract server, an attacker can force the system to install malicious software with administrative privileges. This could lead to complete system compromise, data theft, or permanent service disruption.
Technical details
An input validation and injection vulnerability exists in the Canonical ubuntu-pro-client (formerly ubuntu-advantage-tools). The client uses Python's str.format() to construct APT source files from data received via the directives.suites[] and directives.aptURL fields without proper escaping or newline filtering. An attacker capable of manipulating the contract response (via intercepted connections or compromised infrastructure) can inject arbitrary deb configuration lines. When combined with the unvalidated additionalPackages[] field passed to a root-executed apt-get install command, this allows for the installation of malicious packages and arbitrary code execution as root. The issue is fixed in version 37.3 and corresponding backported versions for Ubuntu LTS releases.
Affected products
- Canonical ubuntu-pro-client < 37.3
- Canonical Ubuntu 26.04 LTS < 37.2ubuntu0.1
- Canonical Ubuntu 24.04 LTS < 37.2ubuntu~24.04.1
- Canonical Ubuntu 22.04 LTS < 37.2ubuntu~22.04.1
Timeline
- 2026-07-16: disclosed
- 2026-07-16: advisory