In wsl-pro-service before 0.1.19ubuntu3, the service component which runs as root inside each WSL instance attaches the instance to Ubuntu Pro by executing the pro client with the Ubuntu Pro token passed as a command-line argument (pro attach <token>). On systems where /proc is mounted without process-hiding mitigations (such as hidepid), which is the default in WSL, an unprivileged local user or process in the same WSL instance can read the token from /proc/<pid>/cmdline while the attach process is running. The leaked token could then be used to attach other machines to the victim's Ubuntu Pro subscription and gain unauthorized access to Ubuntu Pro services.

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Attack Requirements Present

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
Canonical Ubuntu Pro for WSL unaffected
Version Status Constraints
0.1.1 affected < 0.1.19ubuntu2
0.1.1 affected < 0.1.18~24.04.3
0.1.1 affected < 0.1.18~22.04.2
0.1.1 affected < 0.1.18~20.04.2

No data.

No data.

No data.

Project Subscriptions

No data.

Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://github.com/canonical/ubuntu-pro-for-wsl/commit/11c164a37b806bcf2a2304beb0d65e406739778b cve-icon cve-icon
https://github.com/canonical/ubuntu-pro-for-wsl/pull/1816 cve-icon cve-icon
https://ubuntu.com/security/CVE-2026-102371 cve-icon cve-icon
History

Tue, 29 Sep 2026 14:30:00 +0000

Type Values Removed Values Added
Description In wsl-pro-service before 0.1.19ubuntu3, the service component which runs as root inside each WSL instance attaches the instance to Ubuntu Pro by executing the pro client with the Ubuntu Pro token passed as a command-line argument (pro attach <token>). On systems where /proc is mounted without process-hiding mitigations (such as hidepid), which is the default in WSL, an unprivileged local user or process in the same WSL instance can read the token from /proc/<pid>/cmdline while the attach process is running. The leaked token could then be used to attach other machines to the victim's Ubuntu Pro subscription and gain unauthorized access to Ubuntu Pro services.
Title wsl-pro-service: Ubuntu Pro token exposed via process command-line arguments
Weaknesses CWE-214
References
Metrics cvssV4_0

{'score': 5.7, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N'}

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: canonical

Published:

Updated: 2026-09-29T14:11:19.350Z

Reserved: 2026-09-28T23:44:11.787Z

Link: CVE-2026-102371

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-29T15:17:17.557

Modified: 2026-09-29T15:17:17.557

Link: CVE-2026-102371

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses