CVE-2026-102371: wsl-pro-service: Ubuntu Pro token exposed via process command-line arguments

Severity: medium (CVSS 5.7 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-09-29 · updated 2026-09-30
Weakness: CWE-214

Description

In wsl-pro-service before 0.1.19ubuntu3, the service component which runs as root inside each WSL instance attaches the instance to Ubuntu Pro by executing the pro client with the Ubuntu Pro token passed as a command-line argument (pro attach <token>). On systems where /proc is mounted without process-hiding mitigations (such as hidepid), which is the default in WSL, an unprivileged local user or process in the same WSL instance can read the token from /proc/<pid>/cmdline while the attach process is running. The leaked token could then be used to attach other machines to the victim's Ubuntu Pro subscription and gain unauthorized access to Ubuntu Pro services.

Affected products

Canonical Ubuntu Pro for WSL: from 0.1.1 before 0.1.19ubuntu2; from 0.1.1 before 0.1.18~24.04.3; from 0.1.1 before 0.1.18~22.04.2; from 0.1.1 before 0.1.18~20.04.2 — fixed in 0.1.18~20.04.2, 0.1.18~22.04.2, 0.1.18~24.04.3, 0.1.19ubuntu2

How to fix

Upgrade to a fixed version: Canonical Ubuntu Pro for WSL 0.1.18~20.04.2, 0.1.18~22.04.2, 0.1.18~24.04.3, 0.1.19ubuntu2. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-102371 or the next vulnerability affects your stack