Linux administrators’ trust in package managers is being tested by a newly disclosed vulnerability in APT, the package management system used by Debian, Ubuntu, and their derivatives, that could allow attackers to install unverified software with root privileges.
Tracked as CVE-2026-109518, the vulnerability could let an attacker positioned to manipulate HTTP traffic between an APT client and an archive server install an attacker-controlled package without verification.
Debian disclosed the flaw on November 4, crediting security researcher Max Justicz. Ubuntu subsequently rated it High, assigning it a CVSS score of 7.7.
“I used an AI for two hours and found a zero-day that would let a nation-state hack any server running stock Ubuntu,” Justicz said in an X post. Successful exploitation could allow arbitrary code execution with root privileges on a vulnerable machine.
Both distributions have issued fixes.
The problem lies in APT’s handling of HTTP redirects and resumed downloads.
“APT can merge two different package downloads after an HTTP redirect gives them the same URI,” Debian’s advisory said. “Improper file handling when resuming an HTTP download allows a man-in-the-middle (MitM) attacker to replace a package after verification, resulting in the execution of arbitrary code as root.”
APT developers provide a more detailed explanation: an attacker can exploit redirects and transient HTTP server errors that trigger download retries, causing APT to override existing hard links with a chosen payload. Because Debian packages are installed with root privileges, successfully substituting a package can lead to arbitrary code execution as root.
Ubuntu described the required attack position as an on-path attacker able to manipulate traffic between the package client and the archive server. A malicious mirror or proxy could provide that position, but the attack requires specific download conditions.
The vulnerability depends on APT’s Acquire::Retries setting being non-zero. APT developers say this has been the default since version 2.3.2, although scripts may have enabled retries on older installations. Ubuntu specifies that the default retry value of three applies from Debian 12 (Bookworm) and Ubuntu 22.04 LTS (Jammy Jellyfish) onward. Older releases are not exposed by default, but may still be vulnerable if retries have been enabled.
Debian 13 (Trixie) is patched in APT 3.0.4, while Debian 12 (Bookworm) received the fix in version 2.6.2. Ubuntu has also released patched packages for supported releases, including 22.04 LTS, 24.04.LTS, and 26.04 LTS. Ubuntu 26.10 was also affected, with its fix being published when Ubuntu’s November 4 advisory appeared. The fix addresses the underlying file-handling issue. In a commit authored on October 12, APT developer Julian Andres Klode changed the download code to open destination files exclusively, unlinking existing files before copying over any partially downloaded content.
The change prevents downloads from writing through existing hard links, which could otherwise redirect writes to unintended files.
Ubuntu recommends updating APT and temporarily disabling retries during remediation. It also advises using HTTPS for package downloads, which protects against traffic manipulation in this attack scenario. For enterprise security teams, the priority is to identify vulnerable installations, check retry configurations, and ensure patched packages reach production systems and the Linux images used to provision them.