# CVE-2026-11386: Canonical ubuntu-pro-client code execution via APT source injection

Source: https://junglewise.ai/threats/cve-2026-11386-canonical-ubuntu-pro-client-code-execution-via-apt-source  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-16. Updated: 2026-07-16  
License: CC BY 4.0 with a link back

CVE-2026-11386 · Severity: critical · CVSS 9 · Published 2026-07-16

A vulnerability in the Ubuntu Pro client, a tool preinstalled on Ubuntu Server and cloud images, could allow an attacker to take full control of a system. By manipulating the data sent from a contract server, an attacker can force the system to install malicious software with administrative privileges. This could lead to complete system compromise, data theft, or permanent service disruption.

Technologies: [Canonical Ubuntu](https://junglewise.ai/threats/technologies/ubuntu), [Canonical Ubuntu-Pro-Client](https://junglewise.ai/threats/technologies/ubuntu-pro-client). Vendors: [Canonical](https://junglewise.ai/threats/vendors/canonical).

## Quick answers

**Is CVE-2026-11386 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-11386 being exploited in the wild.

**How severe is CVE-2026-11386?** Critical severity, with a CVSS score of 9, published 16 July 2026.

**Which products and versions are affected?** Canonical Ubuntu < 37.3; Canonical Ubuntu-Pro-Client < 37.3.

**Is there a fix for CVE-2026-11386?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-11386 attacked?** It is attacked over the network, in an operating system.

**Am I affected by CVE-2026-11386?** Check whether you run Canonical Ubuntu or Canonical Ubuntu-Pro-Client at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An input validation and injection vulnerability exists in the Canonical ubuntu-pro-client (formerly ubuntu-advantage-tools). The client uses Python's str.format() to construct APT source files from data received via the directives.suites[] and directives.aptURL fields without proper escaping or newline filtering. An attacker capable of manipulating the contract response (via intercepted connections or compromised infrastructure) can inject arbitrary deb configuration lines. When combined with the unvalidated additionalPackages[] field passed to a root-executed apt-get install command, this allows for the installation of malicious packages and arbitrary code execution as root. The issue is fixed in version 37.3 and corresponding backported versions for Ubuntu LTS releases.

## Affected products

- Canonical ubuntu-pro-client < 37.3
- Canonical Ubuntu 26.04 LTS < 37.2ubuntu0.1
- Canonical Ubuntu 24.04 LTS < 37.2ubuntu~24.04.1
- Canonical Ubuntu 22.04 LTS < 37.2ubuntu~22.04.1

## Timeline

- 2026-07-16: disclosed
- 2026-07-16: advisory

## References

- [https://github.com/canonical/](https://github.com/canonical/)
- [https://launchpad.net/ubuntu/resolute](https://launchpad.net/ubuntu/resolute)
- [https://launchpad.net/ubuntu/noble](https://launchpad.net/ubuntu/noble)
- [https://launchpad.net/ubuntu/jammy](https://launchpad.net/ubuntu/jammy)
- [https://launchpad.net/ubuntu/focal](https://launchpad.net/ubuntu/focal)
- [https://launchpad.net/ubuntu/bionic](https://launchpad.net/ubuntu/bionic)
- [https://launchpad.net/ubuntu/xenial](https://launchpad.net/ubuntu/xenial)

## Related threats

- [APT package manager hard link reuse remote code execution](https://junglewise.ai/threats/cve-2026-109518-on-debian-ubuntu-and-derivative-linux-distributions-an-on-path)
- [Canonical snapd sandbox confinement bypass in snap-confine](https://junglewise.ai/threats/cve-2026-15226-canonical-snapd-sandbox-confinement-bypass-in-snap-confine)
- [Canonical snapd access control bypass in AppArmor configuration](https://junglewise.ai/threats/cve-2024-5300-canonical-snapd-access-control-bypass-in-apparmor-configuration)
- [Canonical ubuntu-pro-client information disclosure via process arguments](https://junglewise.ai/threats/cve-2026-9494-canonical-ubuntu-pro-client-information-disclosure-via-process)
- [Canonical ubuntu-pro-client insecure symlink following in collect-logs](https://junglewise.ai/threats/cve-2026-12391-canonical-ubuntu-pro-client-insecure-symlink-following-in-collect)