CVE-2026-46728 is a vulnerability in denx U-Boot prior to version 2026.04 where the FIT signature verification process is flawed because hashed-nodes are omitted from the hash calculation. This omission allows an attacker with local access and high privileges to bypass signature verification, undermining the integrity and authenticity checks of firmware images. The vulnerability is classified as CWE-346 (Origin Validation Error) and has a CVSS 3.1 base score of 8.2, reflecting high impact on confidentiality, integrity, and availability. No vendor patch or official remediation level has been published yet.

Successful exploitation allows an attacker with local privileged access to bypass the FIT signature verification in U-Boot, potentially enabling unauthorized firmware or image modifications. This compromises the integrity and authenticity of the boot process, leading to full system compromise including confidentiality, integrity, and availability impacts. The vulnerability requires local access with high privileges and does not involve user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should restrict local privileged access to affected systems and monitor for updates from denx regarding patches or mitigations.