APT flaw lets a hostile mirror swap a Debian or Ubuntu package for root

APT flaw lets a hostile mirror swap a Debian or Ubuntu package for root

4 November 2026: APT, the package manager on Debian, Ubuntu and their derivatives, has a flaw (CVE-2026-109518) that lets an attacker who sits between a machine and its package archive, such as a malicious mirror or proxy, trick APT into installing a package it has not verified, and so run code as root during an install. Canonical rates it High priority. Debian and Ubuntu shipped fixed packages on 4 November, and neither reports attacks using it.

Not yet independently verified. Debian's own advisory text (DSA-6607-1) did not open for us; the Debian fixed versions come from its security tracker. Neither Debian nor Canonical reports attacks using the flaw. We will update this when it can be confirmed, and remove this note.

APT's security has always rested on one idea: the network can be hostile, because every package is checked against signed archive metadata. This bug breaks that promise in a narrow case, which is why it matters even to teams that never think about their mirrors.

Redirects, retries and a hard link

Max Justicz found that APT mishandles hard links when it meets HTTP redirects and retries a package download. An attacker who can manipulate that traffic can use the sequence to have an unverified file treated as the verified package. Canonical's CVSS v4 vector scores it as reachable over the network with no privileges, needing particular conditions and some user action, such as an administrator running an install.

The condition is retries. The attack needs APT to follow redirects and retry downloads, which happens when Acquire::Retries is set above zero. Canonical's CVE page says the value 3 is the default from Debian 12 (bookworm) and Ubuntu 22.04 LTS onwards, so older releases are not affected unless someone has changed that setting.

Fixed packages by release

Ubuntu, from USN-8996-1:

• 26.10: apt 3.3.3ubuntu0.1;
• 26.04 LTS: 3.2.1ubuntu0.1;
• 24.04 LTS: 2.8.4ubuntu0.1;
• 22.04 LTS: 2.4.15ubuntu0.1;
• 20.04, 18.04, 16.04 and 14.04 LTS: fixes through Ubuntu Pro only.

Debian, from its tracker: bookworm 2.6.2 (DLA-4880-1), trixie 3.0.4 (DSA-6607-1) and sid 3.3.6. The tracker still lists forky at 3.3.5 as vulnerable.

Container images and build servers

The update has to reach every place APT runs, and that is wider than servers. Base images built from Debian or Ubuntu carry the old APT until they are rebuilt, and CI jobs that run apt-get install on each build fetch packages over whatever network the runner sits on. Rebuilding images on the fixed packages closes the gap. Until then, setting Acquire::Retries to 0 removes the condition the attack needs, at the cost of failed installs on a flaky mirror. Pulling packages over HTTPS from a mirror you control, rather than a third-party one, shrinks who can be on the path at all.

Our patch management software category lists seven products.

Sources

• Ubuntu: USN-8996-1, APT vulnerability, 4 November 2026
• Ubuntu: CVE-2026-109518, 4 November 2026
• Debian security tracker: CVE-2026-109518 (read 5 November 2026), 5 November 2026