CVE-2026-33243 barebox: FIT Signature Verification Bypass Vulnerability
An attacker can bypass FIT signature verification in barebox to boot unverified images by modifying the hashed-nodes property.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-33243?
CVE-2026-33243 is a high-severity vulnerability in barebox, published on 20 Mar 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
barebox is a bootloader. In barebox from version 2016.03.0 to before version 2026.03.1 (and the corresponding backport to 2025.09.3), an attacker could exploit a FIT signature verification vulnerability to trick the bootloader into booting different images than those that were verified as part of a signed configuration. mkimage(1) sets the hashed-nodes property of the FIT signature node to list which nodes of the FIT were hashed as part of the signing process as these will need to be verified later on by the bootloader. However, hashed-nodes itself is not part of the hash and could therefore be modified to allow booting different images than those that have been verified. This issue has been patched in barebox versions 2026.03.1 and backported to 2025.09.3.
Weakness: CWE-345
Which versions are affected by CVE-2026-33243?
It affects 1 product.
Products include Pengutronix Barebox.
How do I fix CVE-2026-33243?
Upgrade to a fixed version.
Is CVE-2026-33243 being exploited?
There is no known exploitation of CVE-2026-33243 in the wild and no public exploit code.
Other vulnerabilities in barebox
Sources
Also known as OESA-2026-1834.