The v0.1.19ubuntu3 release of wsl‑pro‑service contains a flaw where the installation token is passed to the pro client as a plain command‑line argument. Because the service runs with root privileges inside WSL and the default /proc exposure settings allow all users to view process command lines, any local, non‑privileged user can read the token while the attach process is executing. With the token, an attacker can attach arbitrary systems to the victim’s Ubuntu Pro subscription, gaining unauthorized access to Ubuntu Pro services.

Canonical’s Ubuntu Pro for WSL, specifically versions prior to 0.1.19ubuntu3. The vulnerability exists in the service component that runs as root within each WSL instance.

The vulnerability carries a CVSS score of 5.7, indicating moderate severity, and does not appear in the CISA KEV catalog. EPSS data is not available, but the exploit requires only local access to the same WSL instance and a suitable /proc mount. Attackers need to observe a command line for a short window while the attach operation is in progress. Once the token is obtained, the attacker can use it to first‑party attach any machine to the Ubuntu Pro subscription.