APT Retry Flaw CVE-2026-109518 Lets MitM Attackers Swap Verified Debian and Ubuntu Packages for Root Code Execution

APT is the trust anchor for software on Debian, Ubuntu and every distribution built on them. On November 4, Debian, Ubuntu and APT's own developers published coordinated advisories for CVE-2026-109518, a flaw that lets an attacker who can modify package downloads replace a package APT has already checked with one of their own. When the package installs, the attacker's code runs as root. APT's developers rate the flaw critical. Ubuntu rates it high priority with a CVSS 4.0 score of 7.7.

The precondition is a position on the network path, not a foothold on the host. Ubuntu says the attacker can be anyone able to change the HTTP traffic between APT and the package server, including a malicious mirror or a malicious proxy. That makes this a software supply chain problem at the transport layer: the signed repository model that organizations rely on is bypassed after verification, not before it.

How the Attack Works

The flaw sits in APT's download retry logic. According to APT's developers, the attacker uses HTTP redirects and ordinary temporary server errors to make APT retry a download. During that retry sequence, the attacker substitutes their own package for the one APT verified. The malicious payload executes when the system installs the package, with the root privileges APT always holds during installation.

Nothing in the chain is exotic. Redirects and transient 5xx style errors are routine traffic on any mirror network, which means the manipulation blends into normal noise. The attack triggers on a routine install or upgrade, the same operation patch management tooling runs on a schedule across entire fleets.

Who Is Affected

Exposure depends on the Acquire::Retries setting. Ubuntu says older releases such as Debian 11 and Ubuntu 20.04 are not exposed by default. APT's developers add an important caveat: many user scripts turn on Acquire::Retries on those older releases anyway, because retries make unattended installs more resilient on flaky networks. Build pipelines, container base images and provisioning scripts are the usual places this setting gets added and then forgotten.

• Debian 12 and later: exposed by default.
• Ubuntu 22.04 LTS and later: exposed by default.
• Debian 11, Ubuntu 20.04 and older: exposed only where Acquire::Retries has been enabled.
• Distributions built on Debian and Ubuntu: Ubuntu says they are affected but did not name any.
• Systems pulling packages over HTTP, through caching proxies, or from third party mirrors carry the most realistic attack paths.

Patch Status as of November 4

Vendor response was fast but uneven. Ubuntu published new APT builds for four releases to its security archive at 14:25 UTC on November 4:

• Ubuntu 26.10: 3.3.3ubuntu0.1
• Ubuntu 26.04 LTS: 3.2.1ubuntu0.1
• Ubuntu 24.04 LTS: 2.8.4ubuntu0.1
• Ubuntu 22.04 LTS: 2.4.15ubuntu0.1

At 15:46 UTC, Ubuntu's tracker still marked all eight releases it tracks for this flaw, from 14.04 LTS to 26.10, as vulnerable. APT's developers say updates for Ubuntu and the Ubuntu Pro subscription service are rolling out, and Ubuntu 14.04 users with Ubuntu Pro can already get a fix. Releases between 14.04 and 22.04 had no published build at the time of the advisories.

Debian has released fixed APT versions for its supported releases. Its testing branch was still on vulnerable APT 3.3.5 at 14:58 UTC on November 4. Debian 11 is a special case: its Debian long-term support ended on August 31, so there is no official Debian channel for a fix. APT's developers stepped in and published a fixed version, 2.2.5, for that release.

Why This Matters for Supply Chain Risk

Most supply chain defenses on Linux rest on one assumption: if the repository metadata is signed and the package hash matches, what installs is what the maintainer shipped. CVE-2026-109518 breaks that assumption at the last step. The package was verified; a different package was installed. Signature enforcement, pinned repositories and trusted keyrings do not help when the swap happens inside the retry path.

The realistic attacker profiles are well understood. A compromised or malicious community mirror can serve every client that points at it. A hostile network position, such as an untrusted Wi-Fi network, a compromised edge device or a rogue transparent proxy, can target individual hosts. Shared caching proxies in corporate networks and CI environments concentrate risk: one compromised cache sits in front of hundreds of build agents and servers that all run apt with root privileges.

Container images add a long tail. Base images built on Debian 12 or Ubuntu 22.04 and later inherit the vulnerable default, and images built on older releases often carry retry settings baked in by build scripts. Image rebuilds against patched APT are what close that exposure, not a host level update.

RedEye Assessment

No exploitation has been reported, and the attack requires network position. That lowers the immediate probability for most hosts but does not lower the stakes: success yields root on any machine that installs a package through the attacker's path, and package installs are automated across most fleets. The combination of a default-on trigger, missing builds for several Ubuntu releases on day one, an unpatched Debian testing branch, unnamed downstream distributions and no published workaround leaves a real exposure window. Organizations running Debian or Ubuntu at scale, particularly through internal mirrors, proxies or CI build infrastructure, should treat this as a priority supply chain issue and confirm vendor fixed APT builds are in place across hosts and images. The flaw was reported by Max Justicz.