Critical Vulnerability in APT Package Manager Enables MitM Package Swapping on Debian and Ubuntu Systems

A critical vulnerability in the Advanced Package Tool (APT) package manager affects Debian and Ubuntu Linux distributions. The flaw, disclosed on November 4, 2026, by Debian, Ubuntu, and the APT Project, exploits APT's default retry-on-failure mechanism to enable man-in-the-middle (MitM) package swapping.

The vulnerability allows an attacker positioned between the user and package repositories to intercept package downloads. When APT encounters a failed download, it retries the request by default. The attacker can intercept this retry and substitute a verified package with a malicious alternative. Because APT processes package installation scripts with root privileges, the swapped package executes with root access, effectively bypassing package verification and integrity checks.

The issue impacts Debian 12 and Ubuntu distributions where APT's default retry behavior is active. An attacker requires MitM positioning, which could be achieved through compromised public Wi-Fi networks, rogue ISPs, or network-level attacks. The vulnerability does not require local access or user interaction beyond the standard package update process.

Debian Security Team, Ubuntu Security Team, and the APT Project have released advisories and patches. The recommended mitigation is to update APT to the latest available version through distribution security repositories. Users are advised to apply security updates via their package manager or system update tools immediately.