CVE-2025-15480 is a critical information exposure (CVSS 9.1) in ubuntu-desktop-provision 24.04.4. After a failed installation, a bug report sent to Launchpad could include the user's password hash in its attached logs. Canonical merged fixes on 9 April 2026. Update, and change the password if you filed such a report.
What's affected
The record says ubuntu-desktop-provision version 24.04.4 is affected. The problem appears only after an installation failure, when the user chooses to submit a bug report to Launchpad. In that case the attached logs could contain the user's password hash.
Canonical's fix removes identity data from logging. It was merged on 9 April 2026 as pull request 1399 on the main branch and as pull request 1400, a backport to the Ubuntu 24.04 branch. The pull requests reference this CVE.
I could not confirm the package version number or Ubuntu security notice that ships the fix from the pages I fetched. Check Ubuntu's security notices and the package changelog for the release that includes it.
How to check if you're exposed
The question is not only which version you run but whether a bug report was ever filed. Check these in order.
- Did an Ubuntu 24.04.4 desktop installation fail on any machine you manage, and did anyone choose to report it?
- Search your Launchpad account's reported bugs for installer crash reports and open the attached log files.
- Look in the logs for the account's password hash. Hashes begin with a
$and a number or letter that names the scheme.
On an installed system, the package version can be read with:
apt policy ubuntu-desktop-provision
The installer runs from install media, so also check Ubuntu's security notice for how the fix reaches new installer images.
What to do now
- Check whether any failed Ubuntu 24.04.4 installation was reported to Launchpad.
- If a report included the logs, delete or restrict the attachment on Launchpad and ask Launchpad support if it was visible to others.
- Change the password for the account created during that install, and for anywhere the same password was reused.
- Use installer media that includes Canonical's fix, and check Ubuntu's security notice for the exact build.
- Tell people to review logs before attaching them to any public bug report.
Why it matters
The record lists CWE-1258, exposure of sensitive information through debug data that was not cleared. In plain terms, sensitive data ended up somewhere it was never meant to go, here a log file. Password hashes are not plain passwords, but a weak password can be recovered from its hash offline, and the hash is a prime target when logs are public.
The CVSS vector scores 9.1 because it is network reachable with no privileges and high confidentiality and availability impact. Real exposure is narrow, since it requires a failed install plus a submitted report. The record does not list it in CISA's Known Exploited Vulnerabilities catalog.
Quick check
Is every Ubuntu 24.04.4 desktop at risk?
No. The record describes the leak only when an installation fails and the user submits a bug report to Launchpad.
Does a hash mean my password is exposed?
Not directly, but weak passwords can be recovered from hashes offline. Change the password if a report with the hash was filed.
Sources
Last reviewed: 19 October 2026.
