HIGH8.1

PYSEC-2026-135

Details

In Ubuntu, Subiquity version 24.04.4 could leak sensitive user credentials during crash reporting. Upon installation failure, if a user submitted a bug report to Launchpad, Subiquity could include certain user credentials, such as the user's plaintext Wi-Fi password, in the attached logs.

Are you affected?

Enter the version of the package you're using.

Affected packages

PyPI/subiquity

Introduced in: 0

No fixed version published yet for subiquity (pip). Pin to a known-safe version or switch to an alternative.

References

https://github.com/canonical/subiquity/pull/2357[FIX]
https://github.com/canonical/subiquity/pull/2358[FIX]