{
  "document": {
    "category": "csaf_vex",
    "csaf_version": "2.0",
    "distribution": {
      "text": "TuxCare License Agreement",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Cloud Linux Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://tuxcare.com/contact/",
      "name": "TuxCare",
      "namespace": "https://tuxcare.com/"
    },
    "references": [
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.tuxcare.com/csaf/v2/els_os/ubuntu18.04els/vex/2026/cve-2026-11386-els_os-ubuntu18_04els.json"
      }
    ],
    "tracking": {
      "current_release_date": "2026-07-17T14:56:51Z",
      "generator": {
        "date": "2026-07-17T14:56:51Z",
        "engine": {
          "name": "pyCSAF"
        }
      },
      "id": "CVE-2026-11386-ELS_OS-UBUNTU18.04ELS",
      "initial_release_date": "2026-07-16T13:16:00Z",
      "revision_history": [
        {
          "date": "2026-07-16T13:16:00Z",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-07-17T14:56:51Z",
          "number": "2",
          "summary": "Official Publication"
        }
      ],
      "status": "final",
      "version": "2"
    },
    "title": "Security update on CVE-2026-11386"
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Ubuntu 18.04",
                "product": {
                  "name": "Ubuntu 18.04",
                  "product_id": "Ubuntu-18",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Ubuntu"
          }
        ],
        "category": "vendor",
        "name": "Canonical Ltd."
      },
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "ubuntu-advantage-tools-1:29.4~18.04+tuxcare.els1.amd64",
                "product": {
                  "name": "ubuntu-advantage-tools-1:29.4~18.04+tuxcare.els1.amd64",
                  "product_id": "ubuntu-advantage-tools-1:29.4~18.04+tuxcare.els1.amd64",
                  "product_identification_helper": {
                    "purl": "pkg:deb/cloudlinux/ubuntu-advantage-tools@1:29.4~18.04%2Btuxcare.els1?arch=amd64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "ubuntu-pro-client-1:32.3~18.04+tuxcare.els1.amd64",
                "product": {
                  "name": "ubuntu-pro-client-1:32.3~18.04+tuxcare.els1.amd64",
                  "product_id": "ubuntu-pro-client-1:32.3~18.04+tuxcare.els1.amd64",
                  "product_identification_helper": {
                    "purl": "pkg:deb/cloudlinux/ubuntu-pro-client@1:32.3~18.04%2Btuxcare.els1?arch=amd64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "ubuntu-pro-client-l10n-1:32.3~18.04+tuxcare.els1.amd64",
                "product": {
                  "name": "ubuntu-pro-client-l10n-1:32.3~18.04+tuxcare.els1.amd64",
                  "product_id": "ubuntu-pro-client-l10n-1:32.3~18.04+tuxcare.els1.amd64",
                  "product_identification_helper": {
                    "purl": "pkg:deb/cloudlinux/ubuntu-pro-client-l10n@1:32.3~18.04%2Btuxcare.els1?arch=amd64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "amd64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "ubuntu-advantage-tools-1:32.3~18.04+tuxcare.els1.all",
                "product": {
                  "name": "ubuntu-advantage-tools-1:32.3~18.04+tuxcare.els1.all",
                  "product_id": "ubuntu-advantage-tools-1:32.3~18.04+tuxcare.els1.all",
                  "product_identification_helper": {
                    "purl": "pkg:deb/cloudlinux/ubuntu-advantage-tools@1:32.3~18.04%2Btuxcare.els1?arch=all"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "ubuntu-pro-auto-attach-1:32.3~18.04+tuxcare.els1.all",
                "product": {
                  "name": "ubuntu-pro-auto-attach-1:32.3~18.04+tuxcare.els1.all",
                  "product_id": "ubuntu-pro-auto-attach-1:32.3~18.04+tuxcare.els1.all",
                  "product_identification_helper": {
                    "purl": "pkg:deb/cloudlinux/ubuntu-pro-auto-attach@1:32.3~18.04%2Btuxcare.els1?arch=all"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "ubuntu-advantage-pro-1:29.4~18.04+tuxcare.els1.all",
                "product": {
                  "name": "ubuntu-advantage-pro-1:29.4~18.04+tuxcare.els1.all",
                  "product_id": "ubuntu-advantage-pro-1:29.4~18.04+tuxcare.els1.all",
                  "product_identification_helper": {
                    "purl": "pkg:deb/cloudlinux/ubuntu-advantage-pro@1:29.4~18.04%2Btuxcare.els1?arch=all"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "ubuntu-advantage-pro-1:32.3~18.04+tuxcare.els1.all",
                "product": {
                  "name": "ubuntu-advantage-pro-1:32.3~18.04+tuxcare.els1.all",
                  "product_id": "ubuntu-advantage-pro-1:32.3~18.04+tuxcare.els1.all",
                  "product_identification_helper": {
                    "purl": "pkg:deb/cloudlinux/ubuntu-advantage-pro@1:32.3~18.04%2Btuxcare.els1?arch=all"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "all"
          }
        ],
        "category": "vendor",
        "name": "CloudLinux"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ubuntu-advantage-tools-1:29.4~18.04+tuxcare.els1.amd64 as a component of Ubuntu 18.04",
          "product_id": "Ubuntu-18:ubuntu-advantage-tools-1:29.4~18.04+tuxcare.els1.amd64"
        },
        "product_reference": "ubuntu-advantage-tools-1:29.4~18.04+tuxcare.els1.amd64",
        "relates_to_product_reference": "Ubuntu-18"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ubuntu-advantage-tools-1:32.3~18.04+tuxcare.els1.all as a component of Ubuntu 18.04",
          "product_id": "Ubuntu-18:ubuntu-advantage-tools-1:32.3~18.04+tuxcare.els1.all"
        },
        "product_reference": "ubuntu-advantage-tools-1:32.3~18.04+tuxcare.els1.all",
        "relates_to_product_reference": "Ubuntu-18"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ubuntu-pro-client-1:32.3~18.04+tuxcare.els1.amd64 as a component of Ubuntu 18.04",
          "product_id": "Ubuntu-18:ubuntu-pro-client-1:32.3~18.04+tuxcare.els1.amd64"
        },
        "product_reference": "ubuntu-pro-client-1:32.3~18.04+tuxcare.els1.amd64",
        "relates_to_product_reference": "Ubuntu-18"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ubuntu-pro-auto-attach-1:32.3~18.04+tuxcare.els1.all as a component of Ubuntu 18.04",
          "product_id": "Ubuntu-18:ubuntu-pro-auto-attach-1:32.3~18.04+tuxcare.els1.all"
        },
        "product_reference": "ubuntu-pro-auto-attach-1:32.3~18.04+tuxcare.els1.all",
        "relates_to_product_reference": "Ubuntu-18"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ubuntu-advantage-pro-1:29.4~18.04+tuxcare.els1.all as a component of Ubuntu 18.04",
          "product_id": "Ubuntu-18:ubuntu-advantage-pro-1:29.4~18.04+tuxcare.els1.all"
        },
        "product_reference": "ubuntu-advantage-pro-1:29.4~18.04+tuxcare.els1.all",
        "relates_to_product_reference": "Ubuntu-18"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ubuntu-advantage-pro-1:32.3~18.04+tuxcare.els1.all as a component of Ubuntu 18.04",
          "product_id": "Ubuntu-18:ubuntu-advantage-pro-1:32.3~18.04+tuxcare.els1.all"
        },
        "product_reference": "ubuntu-advantage-pro-1:32.3~18.04+tuxcare.els1.all",
        "relates_to_product_reference": "Ubuntu-18"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ubuntu-pro-client-l10n-1:32.3~18.04+tuxcare.els1.amd64 as a component of Ubuntu 18.04",
          "product_id": "Ubuntu-18:ubuntu-pro-client-l10n-1:32.3~18.04+tuxcare.els1.amd64"
        },
        "product_reference": "ubuntu-pro-client-l10n-1:32.3~18.04+tuxcare.els1.amd64",
        "relates_to_product_reference": "Ubuntu-18"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-11386",
      "cwe": {
        "id": "CWE-20",
        "name": "Improper Input Validation"
      },
      "notes": [
        {
          "category": "description",
          "text": "An input validation and injection vulnerability exists in Canonical ubuntu-pro-client (formerly ubuntu-advantage-tools). The client constructs APT source files (such as /etc/apt/sources.list.d/ubuntu-.list or their DEB822 equivalents) using data received directly from the contract server response via the directives.suites[] and directives.aptURL fields. Because the client utilizes Python's str.format() to write these files without performing escaping, validation, or newline character filtering, a malicious or tampered contract response containing embedded newline (\\n) characters can successfully inject arbitrary, attacker-controlled deb configuration lines into root-owned APT sources. When combined with the unvalidated additionalPackages[] field—which is passed positionally into a root-executed apt-get install command—an attacker capable of spoofing or manipulating the contract response (e.g., via a compromised internal infrastructure, an intercepted connection utilizing a trusted CA, or local logical bugs) can force the client to fetch and install malicious packages. This ultimately leads to arbitrary code execution with root privileges on the affected system. This component is preinstalled on supported Ubuntu Server releases and auto-attaches by default on cloud provider Ubuntu Pro images.",
          "title": "Vulnerability description"
        }
      ],
      "product_status": {
        "under_investigation": [
          "Ubuntu-18:ubuntu-advantage-pro-1:29.4~18.04+tuxcare.els1.all",
          "Ubuntu-18:ubuntu-advantage-pro-1:32.3~18.04+tuxcare.els1.all",
          "Ubuntu-18:ubuntu-advantage-tools-1:29.4~18.04+tuxcare.els1.amd64",
          "Ubuntu-18:ubuntu-advantage-tools-1:32.3~18.04+tuxcare.els1.all",
          "Ubuntu-18:ubuntu-pro-auto-attach-1:32.3~18.04+tuxcare.els1.all",
          "Ubuntu-18:ubuntu-pro-client-1:32.3~18.04+tuxcare.els1.amd64",
          "Ubuntu-18:ubuntu-pro-client-l10n-1:32.3~18.04+tuxcare.els1.amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://cve.tuxcare.com/els/cve/CVE-2026-11386"
        },
        {
          "category": "external",
          "summary": "https://ubuntu.com/security/CVE-2026-11386",
          "url": "https://ubuntu.com/security/CVE-2026-11386"
        }
      ],
      "release_date": "2026-07-16T13:16:00Z",
      "remediations": [
        {
          "category": "none_available",
          "date": "2026-07-17T12:46:20.255941Z",
          "details": "Affected",
          "product_ids": [
            "Ubuntu-18:ubuntu-advantage-pro-1:29.4~18.04+tuxcare.els1.all",
            "Ubuntu-18:ubuntu-advantage-pro-1:32.3~18.04+tuxcare.els1.all",
            "Ubuntu-18:ubuntu-advantage-tools-1:29.4~18.04+tuxcare.els1.amd64",
            "Ubuntu-18:ubuntu-advantage-tools-1:32.3~18.04+tuxcare.els1.all",
            "Ubuntu-18:ubuntu-pro-auto-attach-1:32.3~18.04+tuxcare.els1.all",
            "Ubuntu-18:ubuntu-pro-client-1:32.3~18.04+tuxcare.els1.amd64",
            "Ubuntu-18:ubuntu-pro-client-l10n-1:32.3~18.04+tuxcare.els1.amd64"
          ]
        }
      ]
    }
  ]
}