Canonical Patches High-Severity APT Flaw Enabling Root Access
CVE-2026-109518 lets an on-path attacker install a malicious .deb package; fixes cover Ubuntu 14.04 LTS through 26.10 and Debian releases.
Canonical disclosed CVE-2026-109518, a High-severity vulnerability in APT, the package manager used by Debian, Ubuntu and derivative distributions, and released fixed packages. The flaw carries a CVSS 4.0 score of 7.7.
According to gamingonlinux.com, an on-path attacker able to manipulate HTTP traffic between a system and an archive server could trigger the installation of an attacker-controlled .deb package and gain root privileges. The flaw sits in the HTTP backend invoked by the APT library and affects frontends including apt, apt-get, aptitude and Ubuntu graphical applications.
Exploitation requires the client to retry a failed download, a behaviour controlled by the Acquire::Retries setting. Ubuntu 22.04 LTS and newer are affected by default. Snap package installation is not affected, and TLS via HTTPS protects against the vulnerability.
Fixed versions
Canonical said it released fixed APT packages for Ubuntu 14.04 LTS through 26.10. Debian fixed the issue in APT 3.0.4 for its stable (trixie) distribution, 3.3.6 for Unstable and 2.6.2 for Bookworm.
Quick answers
What is CVE-2026-109518?
It is a High-severity vulnerability in APT, rated 7.7 under CVSS 4.0, that could let an on-path attacker install a malicious .deb package and gain root privileges.
Which systems are affected?
Ubuntu 22.04 LTS and newer are affected by default, along with Debian and derivative distributions that use APT over HTTP with download retries enabled.
Does HTTPS or Snap protect against the flaw?
Yes. TLS via HTTPS protects against the vulnerability, and Snap package installation is not affected.