# CVE-2026-46728: Das U-Boot and Barebox FIT signature verification bypass

Source: https://junglewise.ai/threats/cve-2026-46728-das-u-boot-and-barebox-fit-signature-verification-bypass  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-16. Updated: 2026-05-16  
License: CC BY 4.0 with a link back

CVE-2026-46728 · Severity: high · CVSS 8.2 · Published 2026-05-16

A vulnerability in the U-Boot and Barebox bootloaders could allow an attacker with physical or local administrative access to bypass secure boot protections. These bootloaders are responsible for verifying that the operating system and firmware are authentic before starting them. By exploiting this flaw, an attacker could replace legitimate system software with malicious code, potentially gaining full control over the device's hardware and data.

Technologies: [Barebox](https://junglewise.ai/threats/technologies/barebox). Vendors: [Barebox](https://junglewise.ai/threats/vendors/barebox).

## Quick answers

**Is CVE-2026-46728 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-46728 being exploited in the wild.

**How severe is CVE-2026-46728?** High severity, with a CVSS score of 8.2, published 16 May 2026.

**Which products and versions are affected?** Barebox v2016.03.0 to v2026.02.0.

**Is there a fix for CVE-2026-46728?** A patch was published on 2026-03-09: Fix committed to U-Boot master Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-46728 attacked?** It is attacked with local access or with physical access, in device firmware.

**Am I affected by CVE-2026-46728?** Check whether you run Barebox at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A vulnerability exists in the Flat Image Tree (FIT) signature verification process within U-Boot and Barebox. When verifying a signed configuration, the bootloader relies on the 'hashed-nodes' property to determine which nodes were included in the signature hash. However, the 'hashed-nodes' property itself is not included in the hash, allowing an attacker with write access to the storage medium to modify this list. By manipulating this property, an attacker can trick the bootloader into skipping verification for malicious image nodes while still presenting a valid signature for the overall configuration. The fix involves ignoring the 'hashed-nodes' property and instead programmatically reconstructing the list of nodes that must be verified based on the configuration.

## Affected products

- Das U-Boot U-Boot v2013.07 to v2025.10
- Barebox Barebox v2016.03.0 to v2026.02.0

## Timeline

- 2026-03-02: disclosed: Privately reported by Apple SEAR
- 2026-03-09: patched: Fix committed to U-Boot master
- 2026-03-17: patched: Fixes included in barebox v2026.03.1 and v2026.09.3
- 2026-05-16: advisory: NVD publication of CVE-2026-46728

## References

- [https://github.com/barebox/barebox/security/advisories/GHSA-3fvj-q26p-j6h4](https://github.com/barebox/barebox/security/advisories/GHSA-3fvj-q26p-j6h4)
- [https://github.com/u-boot/u-boot/commit/2092322b31cc8b1f8c9e2e238d1043ae0637b241](https://github.com/u-boot/u-boot/commit/2092322b31cc8b1f8c9e2e238d1043ae0637b241)

## Related threats

- [barebox integer overflow and heap overflow in EFI PE loader](https://junglewise.ai/threats/cve-2026-34963-barebox-integer-overflow-and-heap-overflow-in-efi-pe-loader)
- [barebox infinite loop in ext4 directory parsing](https://junglewise.ai/threats/cve-2026-34962-barebox-infinite-loop-in-ext4-directory-parsing)
- [barebox out-of-bounds read in ext4 extent parsing](https://junglewise.ai/threats/cve-2026-34961-barebox-out-of-bounds-read-in-ext4-extent-parsing)
- [barebox out-of-bounds read in DHCP option parsing](https://junglewise.ai/threats/cve-2026-34960-barebox-out-of-bounds-read-in-dhcp-option-parsing)
- [barebox FIT signature verification bypass](https://junglewise.ai/threats/cve-2026-33243-barebox-fit-signature-verification-bypass)