Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

Ubuntu Pro for WSL leaks subscription token

published 29 days ago

Summary

The Ubuntu Pro service running inside Windows Subsystem for Linux shows a secret subscription token in the command line when a user enables their subscription. This token could be seen by anyone with access to the system and might be used to reach protected Ubuntu Pro repositories. Apply the latest update from Canonical and regenerate any exposed tokens to protect your environment.

What to do

Update canonical wsl-pro-service to version 0.1.18~20.04.2+esm1.
Update canonical wsl-pro-service to version 0.1.18~22.04.3.
Update canonical wsl-pro-service to version 0.1.18~24.04.4.
Update canonical wsl-pro-service to version 0.1.19ubuntu2.1.

Affected software

Ecosystem	Vendor	Product	Affected versions
Ubuntu:Pro:20.04:LTS	canonical	wsl-pro-service	< 0.1.18~20.04.2+esm1 Fix: upgrade to 0.1.18~20.04.2+esm1
Ubuntu:22.04:LTS	canonical	wsl-pro-service	< 0.1.18~22.04.3 Fix: upgrade to 0.1.18~22.04.3
Ubuntu:24.04:LTS	canonical	wsl-pro-service	< 0.1.18~24.04.4 Fix: upgrade to 0.1.18~24.04.4
Ubuntu:26.04:LTS	canonical	wsl-pro-service	< 0.1.19ubuntu2.1 Fix: upgrade to 0.1.19ubuntu2.1

Original advisory text

wsl-pro-service vulnerability

Darshan U discovered that Ubuntu Pro for WSL exposed the attach token in
command-line arguments when enabling a subscription on a WSL instance.
An attacker could possibly use this issue to obtain sensitive information
and gain unauthorized access to Ubuntu Pro repositories.

References

https://ubuntu.com/security/notices/USN-8892-1 Vendor Advisory
https://ubuntu.com/security/CVE-2026-102371 Third Party Advisory

Timeline

Published6 Oct 2026

Updated7 Oct 2026

First seen7 Oct 2026

Sources

USN-8892-1 · OSV

Track software like this

Free during beta