CVE-2026-82018 IGEL OS 12 / 11 Secure Boot Bypass via Unsigned igel.conf File
Physically present attackers can bypass Secure Boot in IGEL OS to gain root access by exploiting GRUB signature verification flaws.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-82018?
CVE-2026-82018 is a medium-severity vulnerability in IGEL OS 11, published on 28 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
IGEL OS 12 before 12.9.0, 12.8.3 LTS and IGEL OS 11 before 11.11.150 contain a secure boot bypass vulnerability in the GRUB boot stage that allows physically present attackers to gain unauthorized root access by placing an unsigned empty file named igel.conf on a partition. Attackers can exploit GRUB's fail-open signature verification behavior to drop into an interactive GRUB prompt, then boot the device's own kernel with additional command-line arguments to obtain a root shell with the disk unlocked while leaving TPM PCR values unaltered.
Weakness: CWE-636
Which versions are affected by CVE-2026-82018?
How do I fix CVE-2026-82018?
No fix has been published for CVE-2026-82018 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-82018 being exploited?
There is no known exploitation of CVE-2026-82018 in the wild and no public exploit code.
Sources
Also known as GHSA-7c38-49cx-fjvw.