CVE-2026-82018 - IGEL OS 12 / 11 Secure Boot Bypass via Unsigned igel.conf File

Back Back to CVE browser

MEDIUM

IGEL OS 12 / 11 Secure Boot Bypass via Unsigned igel.conf File

Published Aug 28, 2026

6.8

MEDIUM

CVSS 4.0

EPSS 0.25%

Description

IGEL OS 12 before 12.9.0, 12.8.3 LTS and IGEL OS 11 before 11.11.150 contain a secure boot bypass vulnerability in the GRUB boot stage that allows physically present attackers to gain unauthorized root access by placing an unsigned empty file named igel.conf on a partition. Attackers can exploit GRUB's fail-open signature verification behavior to drop into an interactive GRUB prompt, then boot the device's own kernel with additional command-line arguments to obtain a root shell with the disk unlocked while leaving TPM PCR values unaltered.

Affected products

Vendor IGEL Product Igel OS 11 Default
affected
- Version
  11.0.0
  Status
  affected
  Constraints
  <11.11.150
Vendor IGEL Product Igel OS 12 Default
affected
- Version
  12.0.0
  Status
  affected
  Constraints
  <=12.8.2
- Version
  12.8.3
  Status
  unaffected
  Constraints
  -
- Version
  12.9.0
  Status
  unaffected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

IGEL

Igel OS 11

affected

Version	Status	Constraints
11.0.0	affected	<11.11.150

IGEL

Igel OS 12

affected

Version	Status	Constraints
12.0.0	affected	<=12.8.2
12.8.3	unaffected	-
12.9.0	unaffected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-636

References (5)

Link	Providers	Tags
https://blog.amberwolf.com/blog/2026/august/thin-client-thin-crypto-overview/		technical-description
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-67962		Advisory
https://kb.igel.com/en/security-safety/current/isn-2026-20-grub-shell-escape-in-igel-os		vendor-advisorypatch
https://media.defcon.org/DEF%20CON%2034/DEF%20CON%2034%20presentations/DEF%20CON%2034%20presentations/DEF%20CON%2034%20-%20Darren%20McDonald%20-%20Thin%20Client%20Thin%20Crypto%20-%20Bypassing%20Full-Desk%20Encryption%20Across%20Three%20Major%20Thin%20Clients%20Vendors%20without%20Breaking%20a%20Ci.pdf
https://www.vulncheck.com/advisories/igel-os-12-11-secure-boot-bypass-via-unsigned-igel-conf-file		third-party-advisory