{"id":"PYSEC-2026-135","details":"In Ubuntu, Subiquity version 24.04.4 could leak sensitive user credentials during crash reporting. Upon installation failure, if a user submitted a bug report to Launchpad, Subiquity could include certain user credentials, such as the user's plaintext Wi-Fi password, in the attached logs.","aliases":["CVE-2025-14551"],"modified":"2026-05-21T15:00:27.272863559Z","published":"2026-04-09T16:16:23.890Z","references":[{"type":"FIX","url":"https://github.com/canonical/subiquity/pull/2357"},{"type":"FIX","url":"https://github.com/canonical/subiquity/pull/2358"}],"affected":[{"package":{"name":"subiquity","ecosystem":"PyPI","purl":"pkg:pypi/subiquity"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"24.04.4"}]}],"ecosystem_specific":{},"database_specific":{"source":"https://github.com/pypa/advisory-database/blob/main/vulns/subiquity/PYSEC-2026-135.yaml"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H"}]}