APT flaw enables MitM attack with code executed as root

The APT CVE-2026-109518 vulnerability could, under certain circumstances, allow an attacker to spoof a package while it is being downloaded over HTTP and then execute arbitrary code with root privileges. Debian, Ubuntu and the APT developers published information about the vulnerability on November 4. The attack requires the attacker to be able to modify traffic between the client and the archive, for example from a man-in-the-middle (MitM) position, through a malicious mirror or a proxy.

The flaw is tracked as CVE-2026-109518. Ubuntu rates it High and lists a CVSS v4 score of 7.7. Available official advisories do not contain a confirmed case of active exploitation.

How the APT CVE-2026-109518 vulnerability works

The problem affects package downloads over HTTP. According to APT documentation, an attacker can use a combination of redirects and repeated downloads to replace the expected package with their own content. If a user or automated process installs such a package, the result could be execution of the attacker’s code with the highest system privileges.

For the attack scenario to succeed, Acquire::Retries must be nonzero. A value of 3 is the default in Debian 12 and Ubuntu 22.04 LTS. Older releases are therefore not affected by this specific issue under their default configuration.

The official technical advisory describes a procedure involving redirects, transient HTTP errors and hard links. However, the documentation explicitly refers to HTTP traffic. It cannot be inferred from it that the same mechanism also works with sources available exclusively over HTTPS.

Fixes for Debian and Ubuntu

Debian released a fix for the stable Trixie release in package version apt 3.0.4. Debian’s security tracker also lists fixed version 2.6.2 for Debian 12 Bookworm.

Ubuntu lists fixed packages for releases 22.04, 24.04, 26.04 and 26.10. For older supported releases, updates are available through Ubuntu Pro, according to Ubuntu.

System administrators should check whether an APT update is available in the repositories they use and install it using their distribution’s standard update procedure. It is also important to check machines that use HTTP package sources and have a nonzero Acquire::Retries value.

Risk to derivative distributions

APT has a privileged role in Debian and Ubuntu systems because it processes and installs system packages. A failure in this process could, if the conditions are met, bypass the expected signature protection and result in malicious code being executed as root.

It has not been confirmed which Debian and Ubuntu derivative distributions have already released their own updates. Users of such systems should follow their vendor’s security channels and verify the version of the installed APT package.

Further developments will depend mainly on the availability of fixes across all repositories and derivative distributions, any reports of exploitation in the wild, and additional recommendations for systems that cannot yet update APT.

Verified and updated: 11/05/2026 06:26