CVE-2026-12391: Ubuntu Pro Client Information Disclosure

CVE-2026-12391 Overview

CVE-2026-12391 is an insecure symlink following vulnerability in Canonical ubuntu-pro-client (formerly ubuntu-advantage-tools). The flaw resides in the pro collect-logs command framework, which gathers diagnostic information into a support archive. The utility creates or uses predictable temporary file paths and user-accessible log directories without verifying file type or ownership. A local unprivileged attacker can plant a symbolic link at a predictable path that points to a root-readable file such as /etc/shadow. When an administrator runs pro collect-logs, the tool follows the symlink and includes the target contents in the resulting archive, which remains readable by the attacker.

Critical Impact
Local unprivileged users can disclose root-owned files, including credential material in /etc/shadow, by leveraging predictable paths followed during log collection.

Affected Products

Canonical ubuntu-pro-client
Canonical ubuntu-advantage-tools (former package name)
Ubuntu systems using the pro collect-logs diagnostic command

Discovery Timeline

2026-07-16 - CVE-2026-12391 published to NVD
2026-07-16 - Last updated in NVD database

Technical Details for CVE-2026-12391

Vulnerability Analysis

The vulnerability is classified under [CWE-59] Improper Link Resolution Before File Access, commonly known as a symlink following flaw. The pro collect-logs command runs with root privileges to assemble diagnostic data from system log paths and temporary working directories. During this process, the utility opens files at predictable locations without validating that each path is a regular file or that its ownership matches the expected system account.

Because the destination paths are predictable and reside in world-writable or user-accessible directories, an unprivileged local user can pre-create a symbolic link at any such path. When the administrator later invokes pro collect-logs, the tool dereferences the attacker-controlled link, reads the linked file with root privileges, and writes the contents into the support archive. The generated archive is left readable by the invoking user context or placed at a location the attacker can access, enabling extraction of sensitive data.

Root Cause

The root cause is missing validation of file type, ownership, and link status prior to opening files during log collection. The utility trusts predictable filesystem paths and does not use safe primitives such as O_NOFOLLOW, lstat checks, or ownership verification before reading candidate log files.

Attack Vector

Exploitation requires local access with unprivileged credentials and user interaction from a root administrator running pro collect-logs. The attacker places a symlink at a predictable path pointing to a target file such as /etc/shadow or files under /root. Once the diagnostic archive is generated, the attacker retrieves the archive and extracts the disclosed content. No memory corruption or code execution is required.

Refer to the Ubuntu Security Advisory CVE-2026-12391 for vendor technical details.

Detection Methods for CVE-2026-12391

Indicators of Compromise

Symbolic links present in predictable ubuntu-pro-client working paths or log directories that resolve to files outside the expected log tree, such as /etc/shadow, /root/, or /etc/ssh/.
Support archives produced by pro collect-logs containing entries whose paths or contents correspond to sensitive root-owned files.
Unprivileged user accounts creating files or links in directories used by ubuntu-pro-client immediately prior to administrator log collection.

Detection Strategies

Audit filesystem events with auditd rules on the paths used by ubuntu-pro-client to flag symlink and symlinkat syscalls originating from non-root users.
Inspect generated pro collect-logs tar archives before distribution to confirm that only expected log files are present.
Monitor process execution of pro collect-logs correlated with recent write activity in its working directories by unprivileged users.

Monitoring Recommendations

Enable Linux audit logging for symlink, symlinkat, and open syscalls targeting ubuntu-pro-client staging directories.
Alert on execution of pro collect-logs outside of change windows or by service accounts.
Review archive contents automatically for filenames or content signatures matching /etc/shadow, SSH host keys, or other high-value files.

How to Mitigate CVE-2026-12391

Immediate Actions Required

Update ubuntu-pro-client to the fixed version published in the Ubuntu security advisory using apt update && apt install --only-upgrade ubuntu-pro-client.
Avoid running pro collect-logs on multi-user systems until the patched version is installed.
Inspect predictable staging directories for pre-existing symbolic links planted by unprivileged users before running diagnostics.

Patch Information

Canonical has published fixed package versions through the Ubuntu security channels. See the Ubuntu Security Advisory CVE-2026-12391 for the list of supported releases and the corresponding fixed package versions. Apply updates through standard Ubuntu update mechanisms and verify the installed version after upgrade.

Workarounds

Run pro collect-logs only from a trusted, single-user maintenance session where no unprivileged users can pre-stage files.
Restrict permissions on ubuntu-pro-client working directories so that only root can create entries within them.
Review the generated support archive for unexpected sensitive content before sharing it with third parties.

bash

# Configuration example: update ubuntu-pro-client and verify installed version
sudo apt update
sudo apt install --only-upgrade ubuntu-pro-client
dpkg -l ubuntu-pro-client | awk '/ubuntu-pro-client/ {print $2, $3}'