APT CVE-2026-109518: Package Swap to Root on Debian/Ubuntu

What to do

1. Update apt itself first: sudo apt-get update && sudo apt-get install --only-upgrade apt, then confirm the version with apt-cache policy apt.
2. Rebuild Docker base images and CI runner images so they ship the fixed apt; do not rely on the next routine rebuild.
3. Until a host is patched, install packages only from HTTPS sources or a mirror you control, and avoid untrusted networks and shared proxies.
4. On older releases, check whether Acquire::Retries was set: apt-config dump | grep -i retries.
5. As a stopgap on hosts you cannot update yet, set Acquire::Retries "0"; in /etc/apt/apt.conf.d/ (this is our inference from the advisory's precondition, not a vendor workaround).
6. Inventory derivative distributions and appliances that bundle APT and track their vendors' updates.

How to check if you are affected or compromised

• Check the installed version with dpkg -l apt or apt-cache policy apt and compare with the fixed versions above.
• Run apt-config dump | grep -i retries to see whether retries are enabled (the default is 3 on Debian 12+ and Ubuntu 22.04+).
• List sources fetched over plain HTTP: grep -rn 'http://' /etc/apt/sources.list /etc/apt/sources.list.d/.
• Run debsums -c (from the debsums package) to find installed files that no longer match their package checksums, and review recent installs in /var/log/apt/history.log.

What happened#

On November 4, 2026, the APT maintainers, Debian and Ubuntu published coordinated fixes for CVE-2026-109518, a flaw in APT, the package manager behind Debian, Ubuntu and their derivatives. Max Justicz found it. The upstream advisory rates it critical and says a remote attacker can use HTTP redirects and transient server errors, which make APT retry a download, to get APT to "override existing hardlinks with a chosen payload." Debian's DSA-6607-1 describes the same flaw from the other side: APT can merge two different package downloads after a redirect gives them the same URI, and improper file handling when a download resumes lets a man-in-the-middle replace a package after it was verified, "resulting in the execution of arbitrary code as root."

That is the important part. APT checks a signed index and the hash of each .deb, and that check is why plain HTTP mirrors have long been considered acceptable. This bug swaps the file after the check, so the signature chain no longer protects you. The CVE record from Canonical scores it 7.7 under CVSS 4.0 (network attack, attack requirements present, passive user interaction) and classifies it as CWE-62 (UNIX hard link) and CWE-367 (TOCTOU).

The same release fixes several out-of-bounds and hardening issues in .deb and deb822 parsing, plus a memory-exhaustion bug in retry logging. Upstream expects those to cause denial of service at most, for example in PackageKit or aptdaemon.

Who is affected#

The attack needs a non-zero Acquire::Retries. According to Ubuntu and the Debian tracker, the default became 3 in Debian 12 (bookworm) and Ubuntu 22.04 LTS, so those releases and everything newer are exposed out of the box. Older releases are unaffected in a default configuration, but upstream warns that many user scripts set the option, so Debian 11 or Ubuntu 20.04 hosts with retries turned on are exposed too.

The attacker has to be able to tamper with HTTP traffic between APT and the archive while a package is being installed. The advisories name a malicious mirror or proxy as examples. In practice that covers hostile Wi-Fi, compromised or rogue mirrors, shared caching proxies, and anyone on the network path of a build that fetches packages over http://. The advisories describe the attack over HTTP and do not discuss HTTPS. Our reading is that TLS to the official archive should stop a pure network-path attacker, but it does nothing against a malicious mirror or a proxy that terminates TLS.

Do you really need to act?#

Yes, but this is a this-week job, not a drop-everything job. No advisory reports exploitation, and the attacker needs a privileged network position. On the other hand, success means root on the machine, and the place this matters most is the place developers rarely think about: CI runners and docker build steps that run apt-get install on every build, often over plain HTTP, sometimes through a shared cache. A package swapped into a base image spreads to every container built from it.

Patching is easy: one package, with fixes already in the Debian and Ubuntu security archives. Ubuntu 20.04 and older get fixes only through Ubuntu Pro.

What to do now#

1. Update APT first, on a network you trust: sudo apt-get update && sudo apt-get install --only-upgrade apt. Confirm with apt-cache policy apt. Fixed versions: bookworm 2.6.2 (DLA-4880-1), trixie 3.0.4, Ubuntu 22.04 2.4.15ubuntu0.1, 24.04 2.8.4ubuntu0.1, 26.04 3.2.1ubuntu0.1, 26.10 3.3.3ubuntu0.1 (USN-8996-1).
2. Rebuild base images and runner images now. In Dockerfiles, put apt-get install --only-upgrade apt right after apt-get update until upstream images catch up.
3. Check your sources: grep -rn 'http://' /etc/apt/sources.list /etc/apt/sources.list.d/. Where possible, move to https:// mirrors or a mirror you operate.
4. On older releases, run apt-config dump | grep -i retries. If a script set retries, update apt there too.
5. If a host cannot be updated yet, setting Acquire::Retries "0"; in a file under /etc/apt/apt.conf.d/ removes the stated precondition. This is our inference from the advisories, not a vendor-documented workaround, and it makes downloads less resilient.

How to tell if you were hit#

There are no published indicators, and a swapped package looks like a normal install in /var/log/apt/history.log. Practical checks: run debsums -c to list installed files that no longer match their package's recorded checksums. Review installs that happened on untrusted networks or through third-party proxies. Look for unexpected maintainer scripts in /var/lib/dpkg/info/. For CI, the simplest assurance is to rebuild images from a patched base and compare the results.

Timeline#

• Oct 12, 2026 — CVE-2026-109518 reserved by Canonical.
• Nov 4, 2026 — APT upstream advisory, DSA-6607-1 (trixie), DLA-4880-1 (bookworm) and USN-8996-1 published; the CVE record goes public at 15:49 UTC.
• Nov 5, 2026 — No exploitation reported as of this date.

Vulnerability records

• CVE-2026-109518 · On Debian, Ubuntu, and derivative Linux distributions, an on-path attacker who can manipulate the HTTP traffic (including a malicious mirror or proxy) between…

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

1. Debian deity list — APT-2026-11-01 security advisory (Julian Andres Klode) lists.debian.org
2. Debian — DSA-6607-1 apt security update lists.debian.org
3. Debian LTS — DLA-4880-1 apt security update lists.debian.org
4. Debian security tracker — CVE-2026-109518 security-tracker.debian.org
5. Ubuntu — CVE-2026-109518 ubuntu.com
6. Ubuntu — USN-8996-1: APT vulnerability ubuntu.com
7. CVE.org — CVE-2026-109518 cve.org

Coverage and analysis

1. The Hacker News — Debian and Ubuntu APT Flaw Lets MitM Attackers Swap Verified Packages and Run Code as Root thehackernews.com