Apt flaw lets attackers replace verified packages and run code as root

On 4 November 2026 Debian and Ubuntu released patches for CVE-2026-109518, a flaw in the apt package manager that can allow an on-path attacker to swap a verified package after apt has performed its checks and run code with root privileges. The issue was discovered by Max Justicz, who previously identified a similar apt vulnerability (CVE-2019-3462) in 2019.

The flaw affects apt and front ends such as apt-get, aptitude and graphical tools across Debian, Ubuntu and derivatives, with exploitation possible when HTTP downloads are used and Acquire::Retries is enabled.

The attack relies on how apt resumes interrupted downloads. With default retries (three by default since apt 2.3.2, shipped in Debian 12 and Ubuntu 22.04), an attacker who can tamper with HTTP traffic can merge two separate downloads and force a retry, causing apt to overwrite a previously verified file with the attacker's payload after the hash check has passed. Since packages install as root, including postinst scripts run by dpkg, the attacker’s code can gain full control of the machine.

The vulnerability is triggered in CI/CD contexts and affects environments such as self-hosted runners, package mirrors and proxies, Docker builds and GitHub-hosted runners where apt is used in automated steps.

Fixed versions are available: Debian 12 (bookworm) 2.6.2; Debian 13 (trixie) 3.0.4; Ubuntu 22.04 LTS 2.4.15ubuntu0.1; Ubuntu 24.04 2.8.4ubuntu0.1; Ubuntu 26.04 3.2.1ubuntu0.1; and Ubuntu 26.10 3.3.3ubuntu0.1. Debian and Ubuntu advisories note no reports of exploitation in the wild as of 5 November 2026.

The article recommends disabling retries during upgrades and patching cutter points in CI runners, mirrors, proxies and developer machines, with tools such as Harden-Runner to identify HTTP package downloads and compromised scripts.