Executive brief
IGEL OS is a thin-client operating system that runs on enterprise endpoint devices. This vulnerability allows an attacker with physical access to bypass secure boot protections in the GRUB bootloader by placing an unsigned configuration file, gaining root access and disabling disk encryption protections without alerting security monitoring systems.
Technical details
The vulnerability exists in IGEL OS's GRUB bootloader implementation, which contains a fail-open signature verification mechanism. An attacker with physical access can place an unsigned empty file named "igel.conf" on a partition. When GRUB's signature verification fails, it defaults to an interactive prompt where the attacker can boot the device's own kernel with additional command-line arguments (e.g., init=/bin/sh), obtaining root shell access. Notably, this attack leaves TPM PCR values unaltered, evading tamper detection. The attack requires physical device access but no authentication. Patches are available: IGEL OS 12.9.0, 12.8.3 LTS, and IGEL OS 11.11.150 or newer.
Affected products
- IGEL OS 12 before 12.9.0, 12.8.3 LTS; 11 before 11.11.150
Timeline
- 2026-06-17: disclosed: Initial publication by IGEL
- 2026-07-22: other: Coordinated disclosure credit added for Darren McDonald from AmberWolf
- 2026-06-30: other: Mitigation and LTS branch information added
- 2026-08-28: advisory: CVE-2026-82018 assigned
- 2026-08-28: patched: Patches released: IGEL OS 12.9.0, 12.8.3 LTS, and 11.11.150