An information disclosure flaw enables the bearer token used for Ubuntu Pro APT authentication to appear as a clear‑text URL component during the download‑file call. The token is passed as part of the command line for /usr/lib/apt/apt-helper, resulting in a string such as https://bearer:<token>@esm.ubuntu.com/… The clear visibility of the bearer token permits a local attacker who can inspect running processes to read the token from /proc/cmdline while the helper executes.

Affected releases include Canonical Ubuntu 14.04 LTS through 26.04 LTS and the ubuntu-pro-client (ubuntu-advantage-tools) package. All versions of these products that contain the documented command‑line invocation are vulnerable.

The CVSS score of 5.5 reflects a moderate severity. Because the EPSS score is < 1% and the flaw is not listed in the CISA KEV catalog, the likelihood of public exploitation is currently unclear. Nevertheless, any unprivileged local user who can read /proc/cmdline can capture the bearer token and use it to access the victim’s Ubuntu Pro or ESM repositories, potentially providing a foothold for further attacks. The vulnerability requires only local access and the absence of process‑hiding mitigations; thus, it is readily exploitable on systems with a default mounted /proc file system.