Vulnerability · high · CVSS 7.7
CVE-2026-109518: apt flaw lets attackers swap packages after verification
Tier B · Patch this week – Put it in the sprint
Who’s exposed: Systems using vulnerable apt clients to download packages
Tier B because: Full takeover OR secrets exposed OR supply chain
Reach
Attack
Damage
Fix
Core infrastructure · Popular tool · Full takeover
What to do
- Patch vulnerable apt clients
- Use Harden-Runner to find HTTP package downloads in CI/CD and investigate related activity
The Brief
- CVE-2026-109518 is a flaw in apt that lets attackers swap packages after they have been verified.
- According to the Step Security blog, the flaw can be used to run code as root.
- The blog recommends patching vulnerable apt clients and using Harden-Runner to find HTTP package downloads and investigate CI/CD activity.
Why it matters
Package verification alone does not protect against this flaw, so systems that install packages through apt could be compromised with root privileges.
The checklist behind the tier
Checklist · 4 of 10 yes
| Yes | Hits tech teams | apt is the Debian/Ubuntu package manager that developers and ops teams run daily. |
| Yes | Core infrastructure | apt is core Linux package infrastructure nearly every team depends on. |
| Yes | Popular tool | apt is a mainstream, widely used package manager, so core infrastructure implies yes. |
| No | Exploited in the wild | Step Security Blog: describes the flaw only; no observed attacks reported. |
| No | Public exploit | Step Security Blog: no mention of published exploit code or PoC. |
| No | Remote, no login | CVSSCVSS: CVE-2026-109518 AV:N/PR:N/UI:P |
| Yes | Full takeover | CVSSCVE-2026-109518: CVSS rates confidentiality and integrity impact high |
| No | Secrets exposed | Step Security Blog: no mention of stolen credentials, keys, or data. |
| No | Supply chain | Step Security Blog: no report of malicious packages shipped through official channels or compromised signing keys. |
| No | No fix yet | Step Security Blog: advises patching vulnerable APT clients, implying a fix exists. |
The official record
From CVE.org, CISA’s Known Exploited Vulnerabilities catalog, FIRST EPSS and the GitHub Advisory Database. Where these answer a checklist fact, they win over the reporting.
CVE-2026-109518 ↗CVSS 7.7 high AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
APT RCE via hard link reuse
- Exploited
- Not in CISA’s exploited catalog
- EPSS
- <1% chance of exploitation in the next 30 days · higher than 61% of all CVEs
- Weakness
- CWE-62, CWE-367
Source
CVE-2026-109518: apt Flaw Lets Attackers Swap Packages After Verification and Run Code as Root ↗ Step Security Blog · 1d ago
First seen · 1 source · Full story page · How tiers are decided