Debian and Ubuntu APT flaw allows package swap
Original title: Debian and Ubuntu APT Flaw Lets MitM Attackers Swap Verified Packages and Run Code as Root
The flaw in APT lets MitM attackers swap verified packages and run code as root when retries are enabled.
APT allows an attacker who can modify package downloads to swap a checked package for their own. The attacker's code runs as root. The flaw requires APT to retry failed downloads, which is enabled by default in Debian 12 and Ubuntu 22.04 and later. Debian and Ubuntu published fixed versions. Older releases may be exposed if retries were enabled manually.
Unconfirmed: No known exploitation of the flaw
- CVE-2026-109518
- Attack via HTTP redirects or temporary errors
- Fixed in Ubuntu 26.10, 26.04 LTS, 24.04 LTS and 22.04 LTS
- Affects distributions built on Debian and Ubuntu
Impact: swap verified packages and run code as root
| Product | Affected | Fixed in |
|---|---|---|
| Debian APT | 12 and later | 3.3.3ubuntu0.1 for Ubuntu 26.10 |
| Ubuntu APT | 14.04 LTS to 26.10 | 3.2.1ubuntu0.1 for Ubuntu 26.04 LTS |
| Ubuntu APT | 22.04 LTS | 2.4.15ubuntu0.1 |
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-109518 | Man-in-the-middle RCE in APT on Debian and Ubuntu | 7.7 | <1% | PoC ×2 |
From the original article
5 min read at thehackernews.com
A flaw in APT, the package manager for Debian and Ubuntu, allows an attacker who can modify package downloads to swap a checked package for their own. The attacker's code then runs as root, according to advisories that Debian, Ubuntu, and APT's developers published on November 4. The attack needs APT to retry failed downloads, which it does by default from Debian 12 and
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.