Threats affecting pkg:github/wsl-pro-service

CVE-2026-102371 is a medium severity vulnerability in Canonical's Ubuntu Pro for WSL service component before version 0.1.19ubuntu3. The service runs as root inside each WSL instance and attaches the instance to Ubuntu Pro by executing the pro client with the subscription token passed as a command-line argument. On systems where /proc is mounted without process-hiding mitigations (the default in WSL), unprivileged local users can read the token from the command line of the running attach process. This token leakage could allow unauthorized attachment of other machines to the victim's Ubuntu Pro subscription, granting access to Ubuntu Pro services.