Vulnerability · Published Sep 29, 2026 · Assigned by canonical
CVE-2026-102371wsl-pro-service: Ubuntu Pro token exposed via process command-line arguments
Medium 5.7
In plain English
A medium-severity security flaw in Ubuntu Pro for WSL from Canonical. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 1% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
In wsl-pro-service before 0.1.19ubuntu3, the service component which runs as root inside each WSL instance attaches the instance to Ubuntu Pro by executing the pro client with the Ubuntu Pro token passed as a command-line argument (pro attach <token>). On systems where /proc is mounted without process-hiding mitigations (such as hidepid), which is the default in WSL, an unprivileged local user or process in the same WSL instance can read the token from /proc/<pid>/cmdline while the attach process is running. The leaked token could then be used to attach other machines to the victim's Ubuntu Pro subscription and gain unauthorized access to Ubuntu Pro services.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu:22.04:LTS | wsl-pro-service | 0.1.18~22.04.3 | USN-8892-1 |
| Ubuntu:22.04:LTS | wsl-pro-service | 0.1.18~22.04.3 | UBUNTU-CVE-2026-102371 |
| Ubuntu:24.04:LTS | wsl-pro-service | 0.1.18~24.04.4 | USN-8892-1 |
| Ubuntu:24.04:LTS | wsl-pro-service | 0.1.18~24.04.4 | UBUNTU-CVE-2026-102371 |
| Ubuntu:26.04:LTS | wsl-pro-service | 0.1.19ubuntu2.1 | USN-8892-1 |
| Ubuntu:26.04:LTS | wsl-pro-service | 0.1.19ubuntu2.1 | UBUNTU-CVE-2026-102371 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Canonical | Ubuntu Pro for WSL | 0.1.1 – before 0.1.19ubuntu20.1.1 – before 0.1.18~24.04.30.1.1 – before 0.1.18~22.04.20.1.1 – before 0.1.18~20.04.2 |
Weakness: CWE-214 · Vector: CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N