A Bad Mirror Can Hand You Root: Patch APT on Debian and Ubuntu
CVE-2026-109518 lets anyone who can tamper with APT's HTTP downloads swap in an unverified package that runs as root on Debian 12+, Ubuntu 22.04+ and derivatives; fixed builds are out.
A bug in APT, the tool that installs software on Debian and Ubuntu, lets anyone who can tamper with package downloads slip in their own package and run code as root. Debian, Ubuntu and APT’s own developers published advisories on Nov. 4 for CVE-2026-109518, as The Hacker News reports. APT’s developers call it critical; fixes are out for most current releases.
For defenders
The bug: an on-path attacker, including a malicious mirror or proxy, who can change HTTP traffic between APT and the archive can use redirects and ordinary temporary server errors to make APT retry a download, and abuse hard-link reuse so an unverified package gets installed. It runs when a package is installed. It needs a non-zero Acquire::Retries, which is the default (3) from Debian 12 and Ubuntu 22.04 on. Debian 11 and Ubuntu 20.04 aren’t exposed by default, but APT’s developers note many scripts turn retries on anyway. The advisories only describe the attack over HTTP and don’t say whether HTTPS sources are exposed. Ubuntu scores it CVSS 4.0 7.7, high priority, and says derivatives are affected too.
Fixed builds (Ubuntu, Nov. 4): 26.10: 3.3.3ubuntu0.1 · 26.04 LTS: 3.2.1ubuntu0.1 · 24.04 LTS: 2.8.4ubuntu0.1 · 22.04 LTS: 2.4.15ubuntu0.1. Ubuntu Pro has a 14.04 fix. Debian has released fixed APT; Debian 11 (out of LTS since Aug. 31) gets 2.2.5 from APT’s developers. Debian testing was still on vulnerable 3.3.5 on Nov. 4.
Exploitation: none reported. Three public proof-of-concept repositories are reported on GitHub, so expect that to change. No workaround is offered for systems that can’t update. Reported by Max Justicz.
What it means for you
If you run Linux servers, desktops or a home lab on Debian, Ubuntu or something built on them (Mint, Pop!_OS, Raspberry Pi OS and the like), this is a patch-today item. The attacker has to be able to tamper with your downloads, for example on a hostile Wi-Fi network or through a compromised mirror, so laptops that update on public networks are the most exposed. If you don’t use Linux, nothing to do.
Do this now
- Update APT itself first (
sudo apt update && sudo apt install --only-upgrade apt) from a network you trust, then run your normal upgrades. - Avoid installing or upgrading packages over public Wi-Fi until APT is patched.
- Check that your package sources point at your distribution’s official mirrors (or a mirror you control), and switch them to HTTPS where your mirror supports it.
CVE at a glance
- CVSS
- 7.7 High (v4.0)
- EPSS
- 0.9% chance of exploitation in the next 30 days (higher than 60.6% of CVEs)
- Exploited in the wild
- Not on CISA’s KEV list
- Public exploit
- Yes, reported in 3 GitHub repositories
Data from NVD, FIRST EPSS and CISA KEV, refreshed automatically. We report whether public exploit code exists but never link to it: fake proof-of-concepts that infect researchers are common.