APT Package Manager Flaw Lets MitM Attacker Swap Signed Packages and Run Code as Root (CVE-2026-109518)
A critical vulnerability in APT, the package manager used by Debian and Ubuntu, allows a man-in-the-middle attacker who can manipulate HTTP traffic between a client and a package repository—such as a malicious mirror or proxy—to substitute a verified package with malicious code that then executes as root. The flaw, tracked as CVE-2026-109518, is triggered when APT retries a failed download, a behavior enabled by default starting with Debian 12 and Ubuntu 22.04. Attackers can force this retry using HTTP redirects and ordinary temporary server errors. Older releases like Debian 11 and Ubuntu 20.04 are not exposed by default, but systems where administrators manually enabled the Acquire::Retries setting remain at risk. The flaw was reported by researcher Max Justicz, and no active exploitation has been observed.
Entenda a falha
A vulnerabilidade
CVE-2026-109518 is a critical flaw in APT, the package manager of Debian and Ubuntu. An attacker who can modify HTTP traffic between APT and the package server, such as a malicious mirror or proxy, can swap a verified package for their own, and the code then runs as root. It is triggered when APT retries a failed download, which is on by default from Debian 12 and Ubuntu 22.04. Debian 11 and Ubuntu 20.04 are not exposed by default, but they are if Acquire::Retries was enabled, for example by scripts. Ubuntu rates it high priority, CVSS 4.0 7.7. Fixes: APT 2.2.5 for Debian 11 and Ubuntu builds 3.3.3ubuntu0.1 (26.10), 3.2.1ubuntu0.1 (26.04), 2.8.4ubuntu0.1 (24.04) and 2.4.15ubuntu0.1 (22.04). Debian testing was still on vulnerable 3.3.5 on November 4.
Como funciona
When a machine installs a package, APT downloads it over HTTP from a repository or mirror and checks it. If the download fails, APT retries it when retries are enabled. An attacker positioned on the path, or running the mirror or proxy, can answer with HTTP redirects and ordinary temporary server errors to push APT into that retry path. The articles do not explain the internal steps, but the outcome is that a package other than the one that was verified ends up installed, and its code runs as root during installation.
Por que é vulnerável
The articles do not state the root cause. What they show is that the flaw sits in the download retry behavior: the retry path lets a checked package be replaced by an attacker-supplied one. The articles do not describe what the fixes change.
Como foi descoberta
Researcher Max Justicz reported the flaw. Debian, Ubuntu and the APT developers published advisories on November 4. The articles do not say how it was found. None of the advisories describe attacks exploiting it in the wild, and none offer a workaround for systems that cannot update.
Explicação gerada por IA a partir da matéria e dos artigos, em 04/11/2026 16:15.
Detalhes técnicos
The vulnerability affects the APT retry mechanism over HTTP; none of the advisories clarify whether HTTPS-based package sources are also exposed. Debian's testing branch remained on the vulnerable APT version 3.3.5 as of 14:58 UTC on November 4. Ubuntu assigned the flaw a CVSS 4.0 score of 7.7 and high priority, and noted that Debian/Ubuntu-derived distributions may also be affected, though none were named. At 15:46 UTC, Ubuntu still listed all eight tracked releases (14.04 LTS through 26.10) as vulnerable despite publishing patches.
Remediação
Debian has released fixed APT versions, including version 2.2.5 for Debian 11 (whose LTS support ended August 31). Ubuntu has published patched builds for Ubuntu 26.10 (3.3.3ubuntu0.1), 26.04 LTS (3.2.1ubuntu0.1), 24.04 LTS (2.8.4ubuntu0.1), and 22.04 LTS (2.4.15ubuntu0.1), with fixes for Ubuntu Pro subscribers on older releases such as 14.04 LTS also being rolled out. No workaround exists for systems unable to update immediately; administrators should apply patches as soon as available and review whether Acquire::Retries is enabled on older releases.
Linha do tempo
-
APT Package Manager Flaw Lets MitM Attacker Swap Signed Packages and Run Code as Root (CVE-2026-109518)
ler a análise desta fonte ocultar
A critical vulnerability in APT, the package manager used by Debian and Ubuntu, allows a man-in-the-middle attacker who can manipulate HTTP traffic between a client and a package repository—such as a malicious mirror or proxy—to substitute a verified package with malicious code that then executes as root. The flaw, tracked as CVE-2026-109518, is triggered when APT retries a failed download, a behavior enabled by default starting with Debian 12 and Ubuntu 22.04. Attackers can force this retry using HTTP redirects and ordinary temporary server errors. Older releases like Debian 11 and Ubuntu 20.04 are not exposed by default, but systems where administrators manually enabled the
Acquire::Retriessetting remain at risk. The flaw was reported by researcher Max Justicz, and no active exploitation has been observed.Technical Details
The vulnerability affects the APT retry mechanism over HTTP; none of the advisories clarify whether HTTPS-based package sources are also exposed. Debian's testing branch remained on the vulnerable APT version 3.3.5 as of 14:58 UTC on November 4. Ubuntu assigned the flaw a CVSS 4.0 score of 7.7 and high priority, and noted that Debian/Ubuntu-derived distributions may also be affected, though none were named. At 15:46 UTC, Ubuntu still listed all eight tracked releases (14.04 LTS through 26.10) as vulnerable despite publishing patches.
Remediation
Debian has released fixed APT versions, including version 2.2.5 for Debian 11 (whose LTS support ended August 31). Ubuntu has published patched builds for Ubuntu 26.10 (3.3.3ubuntu0.1), 26.04 LTS (3.2.1ubuntu0.1), 24.04 LTS (2.8.4ubuntu0.1), and 22.04 LTS (2.4.15ubuntu0.1), with fixes for Ubuntu Pro subscribers on older releases such as 14.04 LTS also being rolled out. No workaround exists for systems unable to update immediately; administrators should apply patches as soon as available and review whether
Acquire::Retriesis enabled on older releases.