APT flaw let an attacker on the network slip an unsigned package past Debian and Ubuntu's checks and gain root
Canonical's post explains when the bug is reachable and how switching APT to HTTPS shuts it off.
Canonical has released fixes for CVE-2026-109518, a vulnerability in APT, the package manager used by Debian, Ubuntu and their derivatives, discovered by Max Justicz. An attacker who can tamper with unencrypted HTTP traffic between a machine and its package server, or a malicious mirror, could get APT to install a package that fails signature verification. Since package scripts run as root, that means a full takeover. It is rated High (CVSS 4.0 score 7.7).
The bug needs APT to retry a failed download, which is on by default only in Ubuntu 22.04 and newer; older releases are affected only if retries were enabled. It affects every APT front end but not snaps, and using HTTPS for package sources blocks it. Fixed versions are listed for every Ubuntu release back to 14.04.
-
APT (software)
After exploring CVE-2026-109518 APT vulnerability fixes available | Ubuntu, the tool itself is introduced in APT (software).
APT is the free-software tool that handles installing and removing software on Debian and Debian-based Linux distributions.
Wikipedia · Wade · 5 min
0 -
Man-in-the-middle attack
After exploring CVE-2026-109518 APT vulnerability fixes available | Ubuntu, the kind of attacker this bug needs is described in Man-in-the-middle attack.
A man-in-the-middle, or on-path, attack is one where an attacker secretly relays and possibly alters communications between two parties.
Wikipedia · Wade · 5 min
0