{"id":3976,"date":"2026-11-04T17:27:04","date_gmt":"2026-11-04T17:27:04","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=3976"},"modified":"2026-11-04T17:27:04","modified_gmt":"2026-11-04T17:27:04","slug":"debian-and-ubuntu-apt-flaw-lets-mitm-attackers-swap-verified-packages-and-run-code-as-root","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=3976","title":{"rendered":"Debian and Ubuntu APT Flaw Lets MitM Attackers Swap Verified Packages and Run Code as Root"},"content":{"rendered":"
\n

\ue804<\/i>Swati Khandelwal<\/span>\ue802<\/i>Nov 04, 2026<\/span><\/span>Linux \/ Vulnerability<\/span><\/p>\n<\/div>\n

\n
<\/a><\/div>\n

A flaw in APT<\/strong>, the package manager for Debian and Ubuntu, allows an attacker who can modify package downloads to swap a checked package for their own.<\/p>\n

The attacker’s code then runs as root, according to advisories that Debian<\/a>, Ubuntu<\/a>, and APT’s developers<\/a> published on November 4. The attack needs APT to retry failed downloads, which it does by default from Debian 12 and Ubuntu 22.04 onward.<\/p>\n

Debian has released fixed versions of APT for the flaw, CVE-2026-109518<\/b>. APT’s developers, who call the flaw critical, say updates for Ubuntu and its Ubuntu Pro subscription service are being released. Ubuntu 14.04 users with Ubuntu Pro can already get one.<\/p>\n

Older releases, such as Debian 11 and Ubuntu 20.04, are not exposed by default, according to Ubuntu. But many user scripts may have turned on the retry setting, Acquire::Retries, on those releases anyway, APT’s developers say.<\/p>\n

Debian’s testing branch was still on the vulnerable version 3.3.5<\/a> at 14:58 UTC on November 4. For Debian 11, whose Debian long-term support ended on August 31<\/a>, APT’s developers have published a fixed version, 2.2.5.<\/p>\n

\n
\"Cybersecurity\"<\/a><\/div>\n<\/div>\n

Ubuntu rates the flaw as high priority, with a CVSS 4.0 score of 7.7, and says that distributions built on Debian and Ubuntu are affected as well, without naming any.<\/p>\n

<\/p>\n

Ubuntu published new APT builds for four of its releases to its security archive<\/a> at 14:25 UTC on November 4:<\/p>\n