Vulnerability · high · CVSS 7.7
APT flaw CVE-2026-109518 lets man-in-the-middle attackers swap packages after verification on Debian and Ubuntu
Tier B · Patch this week – Put it in the sprint
Who’s exposed: Debian and Ubuntu systems running apt with package downloads over HTTP
Tier B because: Full takeover OR secrets exposed OR supply chain
Reach
Attack
Damage
Fix
Core infrastructure · Popular tool · Full takeover
What to do
- Upgrade apt packages to the fixed version for your Debian or Ubuntu release
The Brief
- A flaw in APT lets an attacker who can modify package downloads swap a verified package for their own.
- According to advisories from Debian, Ubuntu and APT developers, the attacker's code then runs as root.
- Debian's advisory recommends upgrading apt packages.
Why it matters
Any apt client that fetches packages over plain HTTP from a compromised mirror or from a position on the network path could be exposed to root code execution.
The checklist behind the tier
Checklist · 4 of 10 yes
| Yes | Hits tech teams | apt is the package manager developers and ops teams use on Debian and Ubuntu systems. |
| Yes | Core infrastructure | apt is core package infrastructure that nearly every Debian and Ubuntu team runs. |
| Yes | Popular tool | apt is a mainstream OS package manager; core infrastructure is always popular tooling. |
| No | Exploited in the wild | No source reports observed attacks or a KEV listing; HN describes the flaw as allowing an attacker, not active exploitation. |
| No | Public exploit | Sources mention only Debian, Ubuntu and APT advisories; none says exploit code or a PoC is published. |
| No | Remote, no login | CVSSCVSS: CVE-2026-109518 AV:N/PR:N/UI:P |
| Yes | Full takeover | CVSSCVE-2026-109518: CVSS rates confidentiality and integrity impact high |
| No | Secrets exposed | No source reports stolen credentials, keys, configs, source code or user data. |
| No | Supply chain | The official package is not compromised; the swap happens in transit after verification, not via a trusted project's channel. |
| No | No fix yet | Step Security: patch vulnerable APT clients; Debian, Ubuntu and APT developers published advisories, implying fixed versions. |
The official record
From CVE.org, CISA’s Known Exploited Vulnerabilities catalog, FIRST EPSS and the GitHub Advisory Database. Where these answer a checklist fact, they win over the reporting.
CVE-2026-109518 ↗CVSS 7.7 high AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
APT RCE via hard link reuse
- Exploited
- Not in CISA’s exploited catalog
- EPSS
- <1% chance of exploitation in the next 30 days · higher than 61% of all CVEs
- Weakness
- CWE-62, CWE-367
Timeline
Debian, Ubuntu and APT developers publish advisories
Hacker News
100 points · 78 comments
Lobsters
Man-in-the-middle arbitrary code execution in Debian’s apt
Lobsters
3 points · 0 comments
The Hacker News
Debian and Ubuntu APT Flaw Lets MitM Attackers Swap Verified Packages and Run Code as Root
Step Security Blog
CVE-2026-109518: apt Flaw Lets Attackers Swap Packages After Verification and Run Code as Root
Full coverage · 3 sources
What developers are saying
Based on 78 comments · Mostly critical
Commenters are alarmed that apt downloads packages over plain HTTP, which lets a man-in-the-middle see and tamper with them. Many argue that package signatures alone are not enough and that repositories should use HTTPS by default. Some note that the advisory gives little guidance on safely updating apt itself, and others say their own systems are not affected.
- Plain HTTP transport35%
- Signing is not enough25%
- Redirect feature should be opt-in15%
- No safe upgrade guidance15%
- Systems not affected10%
In favour
Concerns
- − Packages are fetched over plain HTTP, exposing traffic and enabling tampering
- − Verification happens too late, after the package is already on disk
- − The redirect feature has been broken seriously twice, and its need is questioned
- − Advisory gives little guidance on upgrading a vulnerable apt safely
“It's always been strange to me and I've been saying forever that I don't get why package repos don't use HTTPS.”
“I think this demonstrates exactly why everything should be https.”
“Yikes, that vuln in apt is pretty bad!”
First seen · 3 sources · 78 comments · Full story page · How tiers are decided