CVE-2026-102371

Awaiting Analysis Awaiting Analysis - Queue

Ubuntu Pro Token Exposure in wsl-pro-service

Publication date: 2026-09-29

Last updated on: 2026-09-30

Assigner: Canonical Ltd.

Description

In wsl-pro-service before 0.1.19ubuntu3, the service component which runs as root inside each WSL instance attaches the instance to Ubuntu Pro by executing the pro client with the Ubuntu Pro token passed as a command-line argument (pro attach <token>). On systems where /proc is mounted without process-hiding mitigations (such as hidepid), which is the default in WSL, an unprivileged local user or process in the same WSL instance can read the token from /proc/<pid>/cmdline while the attach process is running. The leaked token could then be used to attach other machines to the victim's Ubuntu Pro subscription and gain unauthorized access to Ubuntu Pro services.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-29

Last Modified

2026-09-30

Generated

2026-10-19

AI Q&A

2026-09-29

EPSS Evaluated

2026-10-18

NVD

CVE-2026-102371

EUVD

EUVD-2026-88962

Affected Vendors & Products

Vendor	Product	Version / Range
ubuntu	pro_service	to 0.1.19ubuntu3 (exc)
canonical	wsl-pro-service	to 0.1.19ubuntu3 (exc)
canonical	ubuntu	to 26.04 (exc)
canonical	ubuntu	to 24.04 (exc)
canonical	ubuntu	to 22.04 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-214	A process is invoked with sensitive command-line arguments, environment variables, or other elements that can be seen by other processes on the operating system.

Attack-Flow Graph

Executive Summary

This vulnerability involves a flaw in the wsl-pro-service before version 0.1.19ubuntu3 where the Ubuntu Pro token is passed as a command-line argument to the pro client. On systems with /proc mounted without process-hiding mitigations, an unprivileged local user can read the token from /proc/<pid>/cmdline while the attach process runs. The leaked token could allow unauthorized attachment of other machines to the victim's Ubuntu Pro subscription.

Detection Guidance

Check if the wsl-pro-service version is before 0.1.19ubuntu3 by running: wsl-pro-service --version. If vulnerable, inspect /proc for processes running pro attach with tokens in cmdline. Look for unauthorized Ubuntu Pro attachments in your Ubuntu Pro dashboard.

Impact Analysis

If you use Ubuntu Pro for WSL on a system where /proc is not properly secured, an attacker with local access could steal your Pro token. This token could then be used to attach other machines to your subscription without permission, potentially consuming your subscription quota or gaining access to restricted Ubuntu Pro services.

Compliance Impact

This vulnerability could potentially violate compliance requirements under GDPR and HIPAA by exposing sensitive Ubuntu Pro tokens. Unauthorized access to these tokens may lead to unauthorized use of Ubuntu Pro services, which could compromise data security and privacy. The exposure risk aligns with GDPR's principles of data protection and HIPAA's safeguards for protected health information.

Mitigation Strategies

Update wsl-pro-service to version 0.1.19ubuntu3 or later. Verify the update by checking the version again. Ensure no unauthorized Ubuntu Pro attachments exist in your account.

Hi! I’m here to help you understand CVE-2026-102371. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70