Debian and Ubuntu APT Flaw CVE-2026-109518 Lets an On-Path Attacker Swap a Verified Package and Run Code as Root — Found With an OpenAI Model

Cyber · 2026-11-06 · By H.A

Debian and Ubuntu APT Flaw CVE-2026-109518 Lets an On-Path Attacker Swap a Verified Package and Run Code as Root — Found With an OpenAI Model

A hard-link reuse bug in APT's resumed, redirected HTTP downloads lets a malicious mirror or proxy install an unverified package as root on Debian 12+, Ubuntu 22.04+ and derivatives, fixed in apt 3.0.4 (DSA-6607-1) and 2.6.2 (DLA-4880-1).

What Happened

Debian has patched a critical flaw in APT, the package manager that Debian, Ubuntu and their many derivatives use to install and update software. Tracked as CVE-2026-109518, the bug lets an attacker who can tamper with a machine's HTTP package traffic get APT to install a package it never verified. Because packages install as root, that means remote code execution as root.

Debian shipped the fix for Debian 13 "trixie" on 4 November 2026 as DSA-6607-1. Debian 12 "bookworm" got it through the LTS advisory DLA-4880-1. No Debian, Ubuntu or APT advisory reports exploitation in the wild.

The flaw was found by Max Justicz, CTO and co-founder of Charge Robotics. He says he found it with OpenAI's GPT-5.6 Sol model through the company's Daybreak Blue defender programme, in about two hours, after asking the model to find bugs "as bad or worse" than one he had reported in the same codebase before. He reported it to Debian in late September.

Technical Details

APT's security model rests on one assumption: packages can come over plain HTTP from any mirror, because APT checks each downloaded file against the cryptographically signed repository metadata before installing it. A hostile mirror or network should be able to slow you down or block you, but never get you to install something it changed.

CVE-2026-109518 breaks that assumption. The Debian security tracker says the root cause is the reuse of hard links in APT's download handling. In practice, Debian's advisory says a resumed HTTP download can be redirected and merged with another package's URI. An on-path attacker, such as a malicious mirror, a compromised proxy or anyone who can intercept HTTP traffic, can get a file that passed verification swapped for attacker-controlled content before installation.

Two conditions are needed:

The second condition decides who is exposed by default. According to the Debian tracker, Acquire::Retries defaults to 3 starting with Debian 12 (bookworm) and Ubuntu 22.04 LTS, so those releases and everything newer are exposed out of the box. Older releases are unaffected by default, unless an administrator turned retries on.

APT's developers rated the issue critical. Canonical has given it a CVSS 4.0 score of 7.7, which reflects the need for a network position.

Who Is Affected

The highest-risk setups fetch packages over plain HTTP from mirrors or caching proxies the organisation does not control, or run on shared networks where traffic can be intercepted.

Patch Status

Fixed versions of the apt source package, per the Debian security tracker:

Ubuntu users should install the apt update from Canonical's security pocket as soon as it reaches their release, and check Ubuntu's CVE page for the fixed version per release.

What To Do Now

Update APT first, then everything else. The update itself travels over the same channel, so do it from a network you trust:

# Check the installed apt version
apt-cache policy apt

# Upgrade only apt first, then the rest
sudo apt-get update
sudo apt-get install --only-upgrade apt
sudo apt-get upgrade

If you cannot patch immediately, turn off download retries as a stopgap:

echo 'Acquire::Retries "0";' | sudo tee /etc/apt/apt.conf.d/99-no-retries

Further hardening that holds up regardless of this bug:

Why It Matters

APT is one of the most widely used pieces of software on Linux servers. Debian and Ubuntu underpin a large share of cloud workloads, container images and data-centre infrastructure, and package installation is one of the few routine operations that hands root to remote content by design. A bug that weakens the verification step goes to the core of how those systems trust their own updates.

How the bug was found matters too. Justicz says he spent around $5,000 on subscriptions and tokens to find several exploitable issues with AI tooling, and he expects many more serious bugs in heavily used but little-audited code to surface in the coming months. For defenders, this one is simple: upgrade apt, prefer HTTPS mirrors, and rebuild the images you ship.

REEF SENTINEL