CVE-2026-109518
Description
A flaw was found in APT. This vulnerability allows an on-path network attacker to achieve arbitrary code execution with administrative (root) privileges by intercepting package downloads. By manipulating network traffic when a client follows redirects and retries a download, an attacker can exploit insecure hard link reuse to force the installation of an unverified, malicious package.
Statement
In Red Hat deployments, this vulnerability is evaluated with an Important impact because an on-path adversary could achieve full administrative takeover by tampering with package downloads, an outcome warranting an Important rating over Moderate despite requiring active traffic interception. Red Hat Enterprise Linux and supported platforms natively utilize RPM and DNF rather than APT for software packaging and system management. As the APT package manager is neither shipped nor supported in standard Red Hat environments, typical installations do not expose this package retry functionality.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
--- CME Mitigation Guidance (2026-11-06) ---
Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.
The highest-value action is to eliminate unverified package substitution by disabling download retries in apt configuration or securing repository transport: upgrade to APT 2.6.2 / 3.0.4 (or the fixed Apt builds), which correct file handling and link management when resuming redirected downloads to prevent unverified file substitution, closing all 2 injection vectors (HTTP redirect injection during package download retries, package file substitution via reused hard links upon download resumption). Until patched, this is only a concern on Debian, Ubuntu, and derivative Linux systems running APT with Acquire::Retries set to a non-zero value — Standard Red Hat environments using RPM and DNF rather than APT are unaffected — so Set Acquire::Retries 0 in apt.conf to prevent download resumption and avoid untrusted mirrors or unencrypted network paths. As a compensating measure, Configure auditd to monitor unexpected hard link creation and unauthorized process execution during package installs, Deploy IPsec or WireGuard to encrypt repository traffic and prevent on-path redirect injection during retries, Maintain SELinux in enforcing mode to confine package installation processes and post-install maintainer scripts, and Enable IMA/EVM appraisal to verify cryptographic integrity and block execution of unsigned substituted binaries. These controls limit blast radius and contain exploitation, but they do not fix the underlying insecure hard link reuse defect — apply the upstream patch to fully remediate.
Highest-impact CME: CME-204 IPsec / WireGuard (Encrypted Transport) (medium)
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 8.1 | N/A | N/A |
| Attack Vector | Network | N/A | N/A |
| Attack Complexity | High | N/A | N/A |
| Privileges Required | None | N/A | N/A |
| User Interaction | None | N/A | N/A |
| Scope | Unchanged | N/A | N/A |
| Confidentiality | High | N/A | N/A |
| Integrity Impact | High | N/A | N/A |
| Availability Impact | High | N/A | N/A |
Vector
Red Hat: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Understanding the Weakness (CWE)
Integrity,Availability,Confidentiality,Other
Technical Impact: Execute Unauthorized Code or Commands; Alter Execution Logic; Other
An attacker can execute malicious code by compromising the host server, performing DNS spoofing, or modifying the code in transit. Executing untrusted code could compromise the control flow of the program. The untrusted code could execute attacker-controlled commands, read or modify sensitive resources, or prevent the software from functioning correctly for legitimate users.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
