On November 4, 2026, Debian and Canonical published coordinated advisories (DSA-6607-1, DLA-4880-1, USN-8996-1) that fix CVE-2026-109518, a flaw in APT that allows an attacker in a man-in-the-middle position to install unverified packages and execute code as root. The flaw breaks the package manager’s trust chain by substituting verified content after an HTTP redirect and a download retry.
Vulnerability mechanism: hard link reuse and redirects
The flaw lies in how APT handles hard links when following an HTTP redirect and retrying the download of the same file. When the server responds with a redirect, the client may assign the same URI to two distinct downloads; upon retry, the originally verified content is overwritten with the attacker-supplied content, without the signature check detecting the change. This silent substitution breaks the package manager’s trust chain.
Max Justicz, the discoverer of the flaw, had previously reported the 2019 redirect bug CVE-2019-3462 that also granted root to a network attacker. The faulty logic persists in the unsafe handling of hard links when the client follows redirects and retries package file downloads, allowing silent substitution of verified content. The finding underscores the recurrence of failure patterns in the download manager.
The vector requires the APT client to follow HTTP redirects and retry downloads, conditions common in official repositories that use mirrors and load balancers. A malicious mirror, a compromised corporate proxy, or a public Wi‑Fi network controlled by the attacker are realistic exposure surfaces for this Man‑in‑the‑Middle attack. The widespread adoption of mirrors increases the likelihood of encountering a controlled node.
Exploitability conditions: Acquire::Retries and default configuration
Exploitation requires the Acquire::Retries configuration to be non-zero. The default value is 3 since Debian 12 (bookworm) and Ubuntu 22.04 LTS (Jammy Jellyfish), so older versions are not vulnerable in their original configuration. This makes the modern standard configuration an unexpected risk factor for administrators who do not review retry parameters.
CVSS v4.0 assigns a base score of 7.7 (High) with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. Low attack complexity and no prior privileges reflect the ease of achieving a man-in-the-middle position, while required user interaction is limited to running apt install or apt upgrade. The metric underscores real exposure in current standard production environments of high criticality.
There are no reports of active exploitation or public exploits as of November 3, 2026, and the CISA KEV catalog does not include it. However, absence of evidence does not equal absence of risk: the software supply chain exposes this surface in cloud, CI/CD, and corporate environments where network channel control is not guaranteed. Continuous vigilance remains essential.
Supply chain impact and derivatives
Any Debian or Ubuntu derivative —Kali, Linux Mint, Pop!_OS, container base images, CI/CD runners— inherits the vulnerability until its maintainer publishes the corresponding backport. The ubiquity of APT as a universal package manager amplifies the potential blast radius beyond upstream distributions. Every layer of the supply chain must validate the apt version before promoting artifacts.
Container images that incorporate vulnerable apt and are automatically rebuilt in pipelines compromise the integrity of deployed software. An attacker with a foothold in the container registry or the build network can inject code into the base system package layer, persisting in production after deployment. Build automation without apt version verification propagates the flaw silently.
The self‑update paradox worsens the scenario: APT must update itself over a trusted network channel. If the attacker controls that channel, they can block or corrupt the apt update itself, preventing remediation and maintaining persistence on the target system. This circular dependency turns the very remediation tool into an attack vector.
Effective mitigations and their real limitations
The definitive mitigation is to update apt to the versions listed in the official advisories: 3.0.4 in trixie, 2.6.2 in bookworm LTS, 3.3.3ubuntu0.1 in Ubuntu 26.10, 3.2.1ubuntu0.1 in 26.04 LTS, 2.8.4ubuntu0.1 in 24.04 LTS, and 2.4.15ubuntu0.1 in 22.04 LTS; ESM versions for 20.04, 18.04, 16.04, and 14.04 require Ubuntu Pro. See USN-8996-1 and DSA-6607-1 for the complete details of each release.
Disabling retries via Acquire::Retries ‘0’; in /etc/apt/apt.conf.d/99no-retries eliminates the Acquire::Retries ≠ 0 condition, but does not address the root cause: the unsafe handling of hard links. It only reduces the exposure window and does not replace the patch. Enforcing HTTPS in sources.list mitigates passive MitM, but does not protect against malicious mirrors or proxies that legitimately terminate TLS in production and high-criticality environments.
Manually verifying hashes with apt download pkg && sha256sum is operationally infeasible at scale; useful only for one-off critical packages. Rebuilding container base images and CI/CD pipelines once the fixed apt is available in each release is mandatory to close the supply chain gap. Integrating version checks into pipelines prevents inadvertent propagation.
Secure update: the trust channel paradox
Running apt update && apt install apt must be performed over a verified network path: local console, validated corporate VPN, or audited internal mirror. If the attacker controls the network path, they can poison the apt update itself, creating an unbreakable compromise loop without physical or out-of-band intervention. Planning an isolated maintenance window drastically reduces the risk.
Operations teams must prioritize updating apt on management bastions, jump servers, and build nodes before exposed workloads. Monitoring the CISA KEV catalog and derivative advisories raises operational priority if the vulnerability is included in future revisions. Coordination between security and operations teams accelerates response.
The structural lesson is that trust in cryptographic package verification is insufficient if installation logic can be subverted by filesystem race conditions. CVE-2026-109518 demonstrates that the trust chain breaks at the moment between verification and installation when the package manager reuses filesystem resources without validating their integrity post‑redirection. Reviewing download handling code in critical package managers is a preventive measure.
Structured reference for readers and AI agents
{
"format": "rafael-fuentes-article/1.0",
"language": "en",
"title": "CVE-2026-109518: APT allows installation of unverified packages and root execution via MitM",
"summary": "A vulnerability in APT allows a MitM attacker to install unsigned packages and gain root; fixed in Debian 12/13 and Ubuntu 22.04-26.10.",
"author": "Rafael Fuentes",
"publicationDate": "2026-11-05T06:01:35.059+01:00",
"eventDate": "2026-11-04",
"url": "https://falifuentes.com/rafael-fuentes-2026-11-05-am-en/",
"translation": {
"language": "es",
"url": "https://falifuentes.com/rafael-fuentes-2026-11-05-am-es/"
},
"topics": [
"Automation and Robotics",
"Cybersecurity",
"Cybersecurity News",
"English",
"Supply Chain"
],
"sources": [
"https://ubuntu.com/security/notices/USN-8996-1",
"https://security-tracker.debian.org/tracker/DSA-6607-1"
]
}