{"id":"CVE-2026-109518","kind":"vulnerability","aliases":["CVE-2026-109518"],"related":[],"title":"APT on Debian and Ubuntu: network attacker can swap a downloaded package and run code as root; fixed in Debian, Ubuntu fix pending","description":"On Debian, Ubuntu, and derivative Linux distributions, an on-path attacker who can manipulate the HTTP traffic (including a malicious mirror or proxy) between an APT client and an archive server triggered by a package install can trick the client into installing an attacker-controlled unverified package and achieve remote code execution with root privileges.\n\n\n\nThe vulnerability is caused by the reuse of hard links and requires the client to follow redirects and retry the download of package files. It requires the client to have a non-zero Acquire::Retries configuration setting; the value 3 is the default starting with Debian 12 (bookworm) and Ubuntu 22.04 LTS (Jammy Jellyfish), so older releases are unaffected in a default configuration","summary":"On Debian, Ubuntu and derivatives, an attacker on the network path or a malicious mirror or proxy can make APT install an unverified attacker-controlled package during a package install. The result is remote code execution with root privileges on the machine running the install.","severity":"high","cvss":7.7,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"apt","fixed":["2.6.2"],"affected":"< 2.6.2","ecosystem":"debian:12"},{"name":"apt","fixed":["3.0.4"],"affected":"< 3.0.4","ecosystem":"debian:13"},{"name":"apt","fixed":["3.3.6"],"affected":"<= 3.3.5","ecosystem":"debian:unstable"},{"name":"apt","fixed":[],"affected":"all supported releases (14.04 to 26.10) per Ubuntu, no fixed version listed yet","ecosystem":"ubuntu"}],"ecosystems":[],"tags":["apt","debian","infrastructure","linux","self-hosted","ubuntu"],"not_affected_if":["default-config-older-release","no-untrusted-mirror-or-proxy"],"how_to_check":"- Debian: run 'dpkg -l apt' (or 'apt --version'); vulnerable if below 2.6.2 on bookworm, below 3.0.4 on trixie, or 3.3.5 on forky.\n- Ubuntu: all releases are listed vulnerable for now; check the Ubuntu CVE page for a fixed apt version.\n- Run 'apt-config dump | grep Acquire::Retries': a non-zero value (default 3 on Debian 12 and Ubuntu 22.04 and later) is required per Ubuntu's description; older releases are unaffected in default config.\n- Look at /etc/apt/sources.list and /etc/apt/sources.list.d/ for http:// mirrors or proxies you do not control; HTTPS-only trusted mirrors reduce the on-path risk.","fix":"Debian: upgrade apt to 2.6.2 (bookworm, DLA-4880-1), 3.0.4 (trixie, DSA-6607-1) or 3.3.6 (sid); forky still shows 3.3.5 as vulnerable. Ubuntu: Ubuntu's page lists apt as Vulnerable on every release (14.04 to 26.10) with no fixed version yet; watch https://ubuntu.com/security/CVE-2026-109518 and run apt upgrade once it ships.","status":"open","published_at":"2026-11-04T16:17:33+00:00","first_seen_at":"2026-11-04T16:28:10+00:00","triaged_at":"2026-11-04T16:28:52+00:00","updated_at":"2026-11-04T16:30:30+00:00","category":"infrastructure","confidence":0.85,"triage":{"at":"2026-11-04T16:28:52Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"APT on Debian and Ubuntu: MITM can force unverified package install as root","impact":"high","summary":"On Debian, Ubuntu and derivatives, an attacker on the network path or a malicious mirror or proxy can make APT install an unverified attacker-controlled package during a package install. The result is remote code execution with root privileges on the machine running the install.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["debian","ubuntu","apt","linux","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker-controlled package runs code as root on the install host.","analyst_note":"Sources give no fixed package version or advisory link; check the Debian and Ubuntu security trackers for the patched APT version.","how_to_check":"- Run `apt-config dump | grep Acquire::Retries` and see whether a value above 0 is set; the default is 3 on Debian 12 and Ubuntu 22.04 and later.\n- Check the release with `cat /etc/os-release` to confirm it is Debian or Ubuntu or a derivative.\n- Review any configured mirrors or proxies in `/etc/apt/sources.list` and `/etc/apt/sources.list.d/` for untrusted hosts.","plain_action":"","needs_analyst":true,"not_affected_if":["default-config-older-release","no-untrusted-mirror-or-proxy"],"who_is_affected":"Systems running APT on Debian, Ubuntu or derivative distributions where the client follows redirects and retries downloads, which is the default for Debian 12 and Ubuntu 22.04 and later with Acquire::Retries set above zero. Older releases are unaffected in a default configuration. Exposure needs an on-path attacker or a malicious mirror or proxy between the APT client and the archive server. unknown whether any other configuration changes the risk.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000778,"input_tokens":4272,"output_tokens":702,"severity_before":"high"},"analyst_status":"done","analyst_note":"Sources give no fixed package version or advisory link; check the Debian and Ubuntu security trackers for the patched APT version.","search":"'-109518':26A,29A '-2026':25A,28A '12':192C '22.04':196C '3':185C 'achiev':138C 'acquir':179C 'apt':1A,30A,31A,32A,33A,34B,61B,114C 'archiv':118C 'attack':7A,48B,66B,99C,133C 'attacker-control':65B,132C 'bookworm':193C 'caus':148C 'client':115C,128C,158C,172C 'code':15A,77B,140C 'configur':181C,208C 'control':67B,134C 'cve':24A,27A 'debian':3A,20A,35B,43B,89C,191C 'default':188C,207C 'deriv':46B,92C 'distribut':94C 'download':11A,165C 'execut':78B,141C 'file':168C 'fix':18A,22A 'follow':160C 'hard':153C 'host':40B 'http':104C 'includ':106C 'infrastructur':36B 'instal':62B,72B,87B,124C,130C 'jammi':198C 'jellyfish':199C 'link':154C 'linux':37B,93C 'lts':197C 'machin':84B 'make':60B 'malici':55B,108C 'manipul':102C 'mirror':56B,109C 'network':6A,51B 'non':177C 'non-zero':176C 'older':201C 'on-path':96C 'packag':12A,68B,71B,123C,136C,167C 'path':52B,98C 'pend':23A 'privileg':81B,144C 'proxi':58B,111C 'redirect':161C 'releas':202C 'remot':76B,139C 'requir':156C,170C 'result':74B 'retri':163C,180C 'reus':151C 'root':17A,80B,143C 'run':14A,85B 'self':39B 'self-host':38B 'server':119C 'set':182C 'start':189C 'swap':9A 'traffic':105C 'trick':126C 'trigger':120C 'ubuntu':5A,21A,41B,44B,90C,195C 'unaffect':204C 'unverifi':64B,135C 'valu':184C 'vulner':146C 'zero':178C","nicknames":[],"mitigations":[],"who_affected":"Systems running APT on Debian, Ubuntu or derivative distributions where the client follows redirects and retries downloads, which is the default for Debian 12 and Ubuntu 22.04 and later with Acquire::Retries set above zero. Older releases are unaffected in a default configuration. Exposure needs an on-path attacker or a malicious mirror or proxy between the APT client and the archive server. unknown whether any other configuration changes the risk.","tier":"B","verified":{"fix":{"at":"2026-11-04T16:30:30Z","by":"analyst","doc":"https://linuxiac.com/apt-3-3-6-released-with-security-fix-for-download-verification-bypass/","run_id":1685},"products":{"at":"2026-11-04T16:30:30Z","by":"analyst","doc":"https://linuxiac.com/apt-3-3-6-released-with-security-fix-for-download-verification-bypass/","run_id":1685}},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["apt"],"ptokens":["apt"],"labels":["apt","debian","high","infrastructure","linux","selfhosted","ubuntu"],"campaign_type":null,"first_public_at":"2026-11-04T16:17:33+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security@ubuntu.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-109518","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109518","severity":null,"published_at":"2026-11-04T16:17:33+00:00","modified_at":"2026-11-04T16:17:33+00:00","first_seen_at":"2026-11-04T16:28:10+00:00","fetched_at":"2026-11-04T16:28:10+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-109518:1685","url":null,"severity":null,"published_at":"2026-11-04T16:30:30+00:00","modified_at":"2026-11-04T16:30:30+00:00","first_seen_at":"2026-11-04T16:30:30+00:00","fetched_at":"2026-11-04T16:30:30+00:00","note":"Debian tracker (bookworm 2.6.2, trixie 3.0.4, sid 3.3.6 fixed) and Ubuntu CVE page (all releases vulnerable, no fix yet) read. DSA-6607-1 page itself did not load; DSA text seen only via Phoronix quote. Not exploited, no PoC found. Tier B; no posts saved."}],"documents":[{"id":68535,"url":"https://security-tracker.debian.org/tracker/CVE-2026-109518","title":"Debian security tracker: CVE-2026-109518","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":68536,"url":"https://ubuntu.com/security/CVE-2026-109518","title":"Ubuntu CVE-2026-109518","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":68537,"url":"https://linuxiac.com/apt-3-3-6-released-with-security-fix-for-download-verification-bypass/","title":"APT 3.3.6 Released with Security Fix","kind":"blog","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":68538,"url":"https://www.phoronix.com/news/Debian-APT-MITM-RCE","title":"Phoronix: Debian APT MITM RCE (quotes DSA-6607-1)","kind":"blog","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":68569,"url":"https://x.com/TheHackersNews/status/2118022366098006308","title":"@TheHackersNews: ‼️ A new Linux APT flaw in Debian and Ubuntu could let MitM attackers swap alrea","kind":"post","source":"x","publisher":null,"text":"‼️ A new Linux APT flaw in Debian and Ubuntu could let MitM attackers swap already-verified packages and execute code as root.\n\nTracked as CVE-2026-109518, it affects default Debian 12+ and Ubuntu 22.04+ setups.\n\nPatches are rolling out.\n\nDetails ↓ https://t.co/mNi6HCZVu0 https://t.co/MZXdcmRhC5\n\nlikes 10 reposts 3","published_at":"2026-11-04T16:47:37+00:00","relation":"discussion","confidence":null,"note":"@TheHackersNews"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}