Security · High impactFan score 45 · Tier B
CVE-2026-109518: apt Flaw Lets Attackers Swap Packages After Verification and Run Code as Root
The Brief
- CVE-2026-109518 is a flaw in apt that lets attackers swap packages after they have been verified.
- According to the Step Security blog, the flaw can be used to run code as root.
- The blog recommends patching vulnerable apt clients and using Harden-Runner to find HTTP package downloads and investigate CI/CD activity.
Why it matters
Package verification alone does not protect against this flaw, so systems that install packages through apt could be compromised with root privileges.
Who’s affected
- Anyone running vulnerable apt clients
- Teams whose CI/CD pipelines download packages with apt over HTTP
What to do
- Patch vulnerable apt clients
- Use Harden-Runner to find HTTP package downloads in CI/CD and investigate related activity
- CVE-2026-109518
- #apt
- #security
- #vulnerability
- #package-management
- #supply-chain
Understand CVE-2026-109518, patch vulnerable APT clients, and use Harden-Runner to find HTTP package downloads and investigate CI/CD activity.