NEWS

Debian and Ubuntu APT Flaw Lets MitM Attackers Swap Verified Packages and Run Code as Root

CVE-2026-109518 lets an attacker who can alter APT downloads replace a checked package with their own, running code as root. Update APT now.

Dylan H.

News Desk

November 4, 2026
3 min read
Debian and Ubuntu APT Flaw Lets MitM Attackers Swap Verified Packages and Run Code as Root

Overview

A flaw in APT, the package manager for Debian and Ubuntu, lets an attacker who can modify package downloads swap a package that APT has already verified for one of their own. The attacker's code then runs as root when the package is installed. Debian, Ubuntu, and APT's developers published advisories on November 4 for CVE-2026-109518, reported by Max Justicz.

Ubuntu rates the issue high priority with a CVSS 4.0 score of 7.7. APT's developers call it critical. The advisories report no exploitation in the wild.

How the Attack Works

The attack depends on APT retrying failed downloads. An attacker positioned to alter HTTP traffic between APT and the package server, for example through a malicious mirror or proxy, uses HTTP redirects and temporary server errors to trigger those retries and replace a package after it has been checked.

Prerequisites

  • The attacker must be able to modify traffic between APT and the package source.
  • APT must retry failed downloads. That is the default on Debian 12 and Ubuntu 22.04 and later.
  • Older releases such as Debian 11 and Ubuntu 20.04 are not exposed by default, but scripts or configs that set Acquire::Retries can make them vulnerable.

Fixed Versions

ReleaseFixed APT version
Ubuntu 26.103.3.3ubuntu0.1
Ubuntu 26.04 LTS3.2.1ubuntu0.1
Ubuntu 24.04 LTS2.8.4ubuntu0.1
Ubuntu 22.04 LTS2.4.15ubuntu0.1
Debian 11 (upstream fix)2.2.5

Ubuntu Pro users can already get a fix for 14.04, and Ubuntu says derivative distributions are also affected. At the time of reporting, Debian testing was still at the vulnerable 3.3.5, and Ubuntu's tracker still listed all eight tracked releases as vulnerable in places, so check the current advisories for your release.

Recommended Actions

  1. Update APT (apt update && apt install --only-upgrade apt) as soon as a fixed build reaches your release.
  2. Use trusted mirrors only, and avoid untrusted networks and proxies for package operations until patched.
  3. Audit for Acquire::Retries settings in /etc/apt/apt.conf.d/ and in automation scripts.
  4. The advisories describe no workaround for systems that cannot update; whether disabling retries mitigates the issue is not confirmed.

Sources

  • The Hacker News: Debian and Ubuntu APT flaw lets MitM attackers swap verified packages
  • Debian, Ubuntu, and APT security advisories, November 4, 2026