CVE-2026-102371

Executive Summary

CVE-2026-102371 is a local information-disclosure vulnerability in Canonical's wsl-pro-service component shipped within Ubuntu on Windows Subsystem for Linux (WSL) instances. On vulnerable systems (wsl-pro-service before version 0.1.19ubuntu3), the root-level service attaches the WSL instance to Ubuntu Pro by executing the pro client with the Ubuntu Pro token passed as a command-line argument, exposing the secret in /proc/<pid>/cmdline. Because WSL mounts /proc without process-hiding mitigations (e.g., hidepid) by default, any unprivileged local user or process in the same WSL instance can read the token while the attach process runs, then use it to enroll other machines into the victim's Ubuntu Pro subscription and access associated services.

Technical Analysis

The vulnerability class is CWE-214: "Insertion of Sensitive Information Into Process Command Line." The wsl-pro-service runs as root inside each WSL instance and is responsible for attaching that instance to Ubuntu Pro. To perform the attach, it invokes the Ubuntu Pro pro client as a subprocess and supplies the Ubuntu Pro token via command-line argument (pro attach <token>). Passing secrets on the command line is inherently unsafe because on Linux the process's argv is materialized in the kernel-exposed pseudo-filesystem at /proc/<pid>/cmdline. That path is readable by any process with the same UID — and, critically, on default configurations, by users and processes that can otherwise observe the process table.

The second necessary condition is the /proc mount posture. On systems where /proc is mounted with process-hiding mitigations (such as hidepid=1 or hidepid=2), unprivileged users cannot enumerate or read other users' process entries, which limits exposure. The NVD description explicitly states that WSL defaults to mounting /proc WITHOUT such mitigations. Consequently, an unprivileged local user or process in the same WSL instance can read /proc/<pid>/cmdline while the attach process is running and extract the token, even though the pro attach process itself is executed as root (UID 0). The privilege boundary is not defeated — no privilege escalation is required — rather, a secret traverses a world-readable interface (process command line) and is observed by a lower-privileged actor.

The attack surface is the local process table within a WSL instance. There is no remote network vector described; exploitation requires local access to the same WSL instance and the ability to read process metadata. The window of exposure is bounded by the lifetime of the pro attach process: the token is present in argv only while that process runs. An attacker who polls /proc during that window can capture the secret; otherwise the opportunity may be missed if the attach operation completes quickly.

The described fix in 0.1.19ubuntu3 addresses the disclosure path by preventing the token from appearing as a command-line argument (for example, by passing it through a non-argv channel such as stdin, an environment-controlled pipe, or a file descriptor), but the exact code change is not specified in the available data and should not be assumed. No public proof-of-concept, exploit code, or Nuclei template is available for this CVE. The attack chain below is therefore described at the vulnerability-class level.

Exploitation Scenarios

No public PoC is available; the attack chain is inferred from the vulnerability class (CWE-214) and the NVD description.

1. Reconnaissance and target identification. The attacker obtains a non-privileged shell or execution context within a WSL instance running an affected wsl-pro-service version (< 0.1.19ubuntu3). The attacker confirms local access and, optionally, identifies whether the system is configured to auto-attach to Ubuntu Pro, since that determines whether an attach operation is likely to occur. Because the disclosure condition is contingent on /proc mount options, the attacker may inspect the mount configuration to determine whether process-hiding mitigations are absent (as stated to be the WSL default).

2. Triggering and observing the flaw. The attacker monitors the process table for the attach operation. When wsl-pro-service initiates the pro attach <token> invocation, the token becomes visible in /proc/<pid>/cmdline for the duration of that process. The attacker reads that file to recover the secret. This requires no elevated privilege and no exploitation primitive — it relies solely on the default WSL /proc posture.

3. Secret capture. The attacker extracts the Ubuntu Pro token from the observed command line. This is a passive, read-only capture; no code execution in the target process is performed. If the attacker misses the execution window, the same technique can be repeated on subsequent attach attempts, if any occur.

4. Post-exploitation impact. With a valid token in hand, the attacker can attach additional machines to the victim's Ubuntu Pro subscription and gain unauthorized access to Ubuntu Pro services. This can result in consumption of the subscription's entitlements, unauthorized enrollment of attacker-controlled hosts, and potential access to any services or support channels gated by that subscription.

Impact Assessment

The vulnerability is a local information-disclosure issue with high confidentiality impact. Using the CVSS v3.1 vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, the attack requires local access (AV:L), has low attack complexity (AC:L), requires low privileges (PR:L), and needs no user interaction (UI:N). Scope is unchanged (S:U), confidentiality is high (C:H), and there is no integrity or availability impact (I:N/A:N). The base score is not provided by the source data (listed as N/A) and should be calculated from the vector rather than assumed.

Affected systems are WSL instances on Windows that include the wsl-pro-service component at a version earlier than 0.1.19ubuntu3. The blast radius is bounded to the individual WSL instance for token capture, but the downstream impact extends to the broader Ubuntu Pro subscription once the token is exfiltrated: any host enrolled with that token joins the victim's subscription. Because the token is a long-lived credential until rotated, the exposure window for misuse is not limited to the attach process lifetime. The CVSS environmental score may be higher in environments where Ubuntu Pro subscriptions are shared across many hosts, since a single captured token can affect multiple systems. There is no CISA KEV listing and no known exploit-in-the-wild evidence in the provided data.

Detection Guidance

Sigma Rule

title: Ubuntu Pro Token Exposure via wsl-pro-service Command Line
id: 8f2b6c41-0d5a-4c9e-9a3b-7e21c4d9f0a2
status: experimental
description: Detects execution of the Ubuntu Pro pro client with an attach token passed as a command-line argument, indicating CVE-2026-102371 exposure in wsl-pro-service before 0.1.19ubuntu3.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-102371
author: valtersit.com
date: 2026-01-01
tags:
  - attack.credential_access
  - attack.t1552
logsource:
  product: linux
  category: process_creation
detection:
  selection_pro:
    Image|endswith: '/pro'
    CommandLine|contains: 'attach'
  selection_token:
    CommandLine|contains|all:
      - 'attach'
      - 'token'
  condition: selection_pro or selection_token
falsepositives:
  - Legitimate administrative use of the pro client with a token argument on non-WSL systems
level: high

YARA Rule

rule CVE_2026_102371_WSL_Pro_Token_Exposure
{
    meta:
        description = "Detects references to CVE-2026-102371 affected component and token-on-command-line pattern"
        author = "valtersit.com"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-102371"
        severity = "high"

    strings:
        $cve = "CVE-2026-102371" ascii wide
        $svc = "wsl-pro-service" ascii wide nocase
        $attach = "pro attach" ascii wide nocase
        $cmdline = "/proc/" ascii wide
        $token = "token" ascii wide nocase

    condition:
        uint16(0) == 0x5A4D or uint32(0) == 0x464C457F or
        (
            any of ($svc) and
            $attach and
            any of ($cmdline, $token)
        )
        or any of ($cve)
}

Suricata IDS Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2026-102371 Possible Ubuntu Pro Token Exfiltration from WSL Instance"; flow:to_server,established; content:"attach"; http_client_body; nocase; pcre:"/(Bearer|token|pro-attach)/i"; threshold:type limit, track by_src, count 5, seconds 60; classtype:attempted-user; sid:2026102371; rev:1;)

Elastic Detection

process where event.type == "start" and
  process.name == "pro" and
  process.args : "attach" and
  process.args : "*token*"

Splunk SPL Query

index=linux sourcetype=linux_audit OR sourcetype=sysmon_linux
(process_name="pro" OR process_name="pro.exe")
(process_command_line="*attach*")
| stats count min(_time) as firstTime max(_time) as lastTime by host, user, process_command_line
| where mvcount(process_command_line) >= 1
| table host, user, firstTime, lastTime, process_command_line

Wazuh OSSEC Rule

<group name="linux,cve,cve_2026_102371,">
  <rule id="202610371" level="10">
    <if_sid>530</if_sid>
    <field name="command">pro attach</field>
    <description>CVE-2026-102371: Ubuntu Pro token passed as command-line argument (wsl-pro-service)</description>
    <mitre>
      <id>T1552</id>
    </mitre>
    <group>credential_access,</group>
  </rule>
  <rule id="202610372" level="12">
    <if_sid>530</if_sid>
    <field name="command">/proc</field>
    <field name="command">cmdline</field>
    <description>CVE-2026-102371: Possible access to /proc/<pid>/cmdline for token recovery</description>
    <mitre>
      <id>T1552</id>
    </mitre>
    <group>credential_access,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations:

   • Since the root cause is disclosure via the process command line, treat any Ubuntu Pro token that may have been exposed on an affected WSL instance as compromised and rotate it.
   • Constrain local access to WSL instances hosting Ubuntu Pro attachments, since the vulnerability requires a local unprivileged user or process in the same instance.
   • Where administratively feasible and supported, evaluate /proc mount hardening (e.g., process-hiding mitigations) to reduce process-metadata visibility. Note this is a defense-in-depth measure and the default WSL /proc posture is the condition described; validate compatibility before applying.
   • Audit which instances are enrolled in Ubuntu Pro and whether their tokens are shared broadly, since a single captured token can enroll additional machines.

2. Patch/upgrade steps:

   • Upgrade wsl-pro-service to version 0.1.19ubuntu3 or later, which is the version boundary identified for this issue.
   • There is no vendor advisory or patch reference in the provided data beyond the version threshold; confirm availability through Canonical's normal Ubuntu package update channels before relying on this fix.
   • After upgrading, rotate any Ubuntu Pro tokens that were in use on affected instances prior to remediation.

3. Long-term hardening:

   • Avoid passing secrets as command-line arguments in service and automation code; prefer non-argv channels such as file descriptors, stdin streams, or protected credential stores. This directly addresses the CWE-214 class.
   • Enforce credential rotation policies and least-privilege enrollment so a single leaked token has limited blast radius.
   • Monitor for unusual pro attach activity and for additional machines being enrolled into a subscription with unexpected tokens.
   • Maintain an inventory of WSL instances and the credentials/services they hold, and apply procedural controls to limit who can run code in those instances.

References

• NVD — CVE-2026-102371: https://nvd.nist.gov/vuln/detail/CVE-2026-102371
• Canonical Ubuntu Pro documentation (product context): https://ubuntu.com/pro
• MITRE ATT&CK T1552 — Unsecured Credentials: https://attack.mitre.org/techniques/T1552/
• CWE-214 — Insertion of Sensitive Information Into Process Command Line: https://cwe.mitre.org/data/definitions/214.html
• CISA Known Exploited Vulnerabilities Catalog (no listing for this CVE as of this report): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No known threat actor campaigns or exploit-in-the-wild evidence are identified in the available data. No public proof-of-concept, Nuclei template, or exploit code was found; exploitation details in this report are inferred from the vulnerability class and the NVD description.