Debian and Ubuntu APT Flaw CVE-2026-109518 Lets an On-Path Attacker Swap a Verified Package and Run Code as Root — Found With an OpenAI Model
A hard-link reuse bug in APT's resumed, redirected HTTP downloads lets a malicious mirror or proxy install an unverified package as root on Debian 12+, Ubuntu 22.04+ and derivatives, fixed in apt 3.0.4 (DSA-6607-1) and 2.6.2 (DLA-4880-1).
What Happened
Debian has patched a critical flaw in APT, the package manager that Debian, Ubuntu and their many derivatives use to install and update software. Tracked as CVE-2026-109518, the bug lets an attacker who can tamper with a machine's HTTP package traffic get APT to install a package it never verified. Because packages install as root, that means remote code execution as root.
Debian shipped the fix for Debian 13 "trixie" on 4 November 2026 as DSA-6607-1. Debian 12 "bookworm" got it through the LTS advisory DLA-4880-1. No Debian, Ubuntu or APT advisory reports exploitation in the wild.
The flaw was found by Max Justicz, CTO and co-founder of Charge Robotics. He says he found it with OpenAI's GPT-5.6 Sol model through the company's Daybreak Blue defender programme, in about two hours, after asking the model to find bugs "as bad or worse" than one he had reported in the same codebase before. He reported it to Debian in late September.
Technical Details
APT's security model rests on one assumption: packages can come over plain HTTP from any mirror, because APT checks each downloaded file against the cryptographically signed repository metadata before installing it. A hostile mirror or network should be able to slow you down or block you, but never get you to install something it changed.
CVE-2026-109518 breaks that assumption. The Debian security tracker says the root cause is the reuse of hard links in APT's download handling. In practice, Debian's advisory says a resumed HTTP download can be redirected and merged with another package's URI. An on-path attacker, such as a malicious mirror, a compromised proxy or anyone who can intercept HTTP traffic, can get a file that passed verification swapped for attacker-controlled content before installation.
Two conditions are needed:
- The client must follow redirects, which APT does over HTTP.
- The client must retry failed package downloads, which requires a non-zero
Acquire::Retriesvalue.
The second condition decides who is exposed by default. According to the Debian tracker, Acquire::Retries defaults to 3 starting with Debian 12 (bookworm) and Ubuntu 22.04 LTS, so those releases and everything newer are exposed out of the box. Older releases are unaffected by default, unless an administrator turned retries on.
APT's developers rated the issue critical. Canonical has given it a CVSS 4.0 score of 7.7, which reflects the need for a network position.
Who Is Affected
- Debian 12 and Debian 13 systems running unpatched apt (2.6.1 and 3.0.3 respectively).
- Ubuntu 22.04 LTS and later, plus derivatives that inherit APT's default retry setting.
- Older systems where
Acquire::Retrieswas set to a non-zero value. - Container images and CI runners built from older base images. Their apt stays at the version baked into the image until it is rebuilt, and
apt-get installduring a build is exactly the moment the bug needs.
The highest-risk setups fetch packages over plain HTTP from mirrors or caching proxies the organisation does not control, or run on shared networks where traffic can be intercepted.
Patch Status
Fixed versions of the apt source package, per the Debian security tracker:
- Debian 13 (trixie): 3.0.4 (DSA-6607-1)
- Debian 12 (bookworm): 2.6.2 (DLA-4880-1)
- Debian testing (forky) and unstable (sid): 3.3.6
Ubuntu users should install the apt update from Canonical's security pocket as soon as it reaches their release, and check Ubuntu's CVE page for the fixed version per release.
What To Do Now
Update APT first, then everything else. The update itself travels over the same channel, so do it from a network you trust:
# Check the installed apt version
apt-cache policy apt
# Upgrade only apt first, then the rest
sudo apt-get update
sudo apt-get install --only-upgrade apt
sudo apt-get upgradeIf you cannot patch immediately, turn off download retries as a stopgap:
echo 'Acquire::Retries "0";' | sudo tee /etc/apt/apt.conf.d/99-no-retriesFurther hardening that holds up regardless of this bug:
- Use HTTPS mirrors (
https://deb.debian.org/debian) so an on-path attacker cannot rewrite responses. - Audit internal mirrors and caching proxies such as apt-cacher-ng, and restrict who can write to them.
- Rebuild container images on patched base images rather than relying on a running update, and pin base image digests.
- Look in
/var/log/apt/history.logand/var/log/dpkg.logfor unexpected installs on hosts that pulled packages through untrusted networks.
Why It Matters
APT is one of the most widely used pieces of software on Linux servers. Debian and Ubuntu underpin a large share of cloud workloads, container images and data-centre infrastructure, and package installation is one of the few routine operations that hands root to remote content by design. A bug that weakens the verification step goes to the core of how those systems trust their own updates.
How the bug was found matters too. Justicz says he spent around $5,000 on subscriptions and tokens to find several exploitable issues with AI tooling, and he expects many more serious bugs in heavily used but little-audited code to surface in the coming months. For defenders, this one is simple: upgrade apt, prefer HTTPS mirrors, and rebuild the images you ship.
