Update APT on Debian and Ubuntu: a bad mirror or proxy can swap a package and run code as root

Debian, Ubuntu and APT's developers disclosed CVE-2026-109518 on November 4. An attacker who can tamper with HTTP traffic to a package server can get an unverified package installed as root. Fixed APT versions are out for Debian 12 and 13 and Ubuntu 22.04 through 26.10.

If you run Debian or Ubuntu machines, update the apt package today. Debian, Ubuntu and APT’s own developers published advisories on November 4 for CVE-2026-109518. An attacker who can tamper with the HTTP traffic between a machine and its package server can get APT to install a package it never verified. The attacker’s code then runs as root.

What the advisories say

The flaw was reported by security researcher Max Justicz. Ubuntu scores it 7.7 on CVSS 4.0 and rates it high priority. APT’s developers call it critical.

The attacker has to sit on the download path: a malicious mirror, a proxy, or a network they control. According to Debian’s security tracker, the bug comes from how APT reuses hard links when it retries a download. The attacker uses HTTP redirects and temporary server errors to force a retry, and the swapped file is installed without its signature check. Installing anything from that session runs their code as root.

It only works when APT retries failed downloads. That is the default on Debian 12 and Ubuntu 22.04 and later, where Acquire::Retries is set to 3. Ubuntu says Debian 11 and Ubuntu 20.04 are not exposed by default. APT’s developers warn that scripts or configs on those releases may have turned retries on. The Hacker News, which reported the advisories, found no reports of the flaw being exploited.

The advisories describe the attack over HTTP. None of them say whether HTTPS package sources are safe, so don’t assume they are.

Fixed versions

Ubuntu marked all eight releases it tracks, from 14.04 to 26.10, as affected. Fixes for the older Ubuntu Pro releases were still rolling out on November 4. Ubuntu also says distributions built on Debian or Ubuntu are affected, without naming them. Sources: Debian’s advisory, Ubuntu’s CVE page and APT’s developers.

Patch from a network you trust, then rebuild your images

Check what you have and whether retries are on:

apt-cache policy apt
apt-config dump | grep -i retries

Then update APT first, before anything else:

sudo apt update && sudo apt install --only-upgrade apt

Three things the advisories don’t spell out, as our inference from how the attack works:

• The fix travels over the channel it protects. Run the update from a network and mirror you trust. Skip the coffee-shop Wi-Fi, an unknown corporate proxy, or a third-party mirror you never vetted. If your sources still use plain http://, this is a good week to move them to HTTPS.
• Containers carry their own APT. A Docker image built on Debian or Ubuntu has the vulnerable version inside it. Rebuild from refreshed base images, and in your Dockerfiles upgrade apt before installing other packages.
• CI runners install packages constantly. Build machines run apt install on every job, often through caching proxies. Patch the runner images and audit which proxy or mirror they point at.

This is the third Linux server fix we’ve covered this week, after the TCP kernel flaw that needs a reboot and the LXD and MicroCloud login bypass. If you self-host GitLab on Alpine, the CVSS 10 regex fix is the same lesson: the patch you need sits in a layer below the app.