Security · High impactFan score 46 · Tier B3 sources78 comments in the community

CVE-2026-109518: apt Flaw Lets Attackers Swap Packages After Verification and Run Code as Root

The Brief

A flaw in APT, the package manager for Debian and Ubuntu, lets an attacker who can modify package downloads swap a verified package for their own.
The attacker's code then runs as root, according to advisories published by Debian, Ubuntu and APT's developers on November 4.
Commenters say APT downloads packages over plain HTTP, so a man-in-the-middle position is enough to exploit the flaw.

Why it matters

Any Debian or Ubuntu system that installs or updates packages over a network path an attacker can influence may run attacker code as root until APT is upgraded.

Who’s affected

Debian and Ubuntu administrators
Teams running APT-based containers and images
Users who fetch packages over plain HTTP

What to do

Upgrade the apt package to the fixed version, as the advisories recommend
Check whether systems still on older Debian releases such as bookworm have received a fix

CVE-2026-109518
#apt
#debian
#ubuntu
#security
#man-in-the-middle
#package-manager

Understand CVE-2026-109518, patch vulnerable APT clients, and use Harden-Runner to find HTTP package downloads and investigate CI/CD activity.

Read the full story at stepsecurity.io ↗

What developers are saying

Based on 78 comments · Mostly critical

Commenters are alarmed that APT's HTTP handling can be exploited by a man-in-the-middle and see it as a repeat of earlier APT flaws. Many argue that package repositories should default to HTTPS, while a few recall that APT's developers had resisted HTTPS on the grounds that signatures were enough. Others criticise the lack of upgrade guidance and note that the fix may not yet cover older releases.

HTTP instead of HTTPS40%
Repeat of earlier APT flaws20%
Redirect feature should be opt-in15%
Fix availability for older releases15%
Lack of upgrade guidance10%

In favour

+ Packages are signed with PGP, which earlier discussions treated as sufficient protection without HTTPS

Concerns

− Plain HTTP lets a man-in-the-middle see which packages are downloaded and whether they are vulnerable
− Repeated serious breakage of the redirect feature suggests it is risky and not clearly needed
− Advisories gave no guidance on securely updating apt itself
− Fixed version appears in trixie-security, but bookworm is not yet fixed

“Would it have killed them to give even a little bit of guidance how to securely update the apt package(s)?”
flotzam on Hacker News

“I think this demonstrates exactly why everything should be https.”
londons_explore on Hacker News

“Since this is the second time the redirect feature was broken in a serious way and there is still no obvious need for it.. time to make it opt-in instead of opt-out?”
edelbitter on Hacker News