CVE-2026-82018: Not Failing Securely ('Failing Open') in IGEL IGEL OS 12

This vulnerability in IGEL OS 12 (versions >=12.0.0 <=12.8.2) and IGEL OS 11 (versions >=11.0.0 <11.11.150) involves a failure to securely handle signature verification in the GRUB bootloader stage. By placing an unsigned empty file named igel.conf on a partition, an attacker with physical access can exploit GRUB's fail-open behavior to access an interactive prompt. From there, the attacker can boot the device's kernel with modified command-line arguments to obtain a root shell with the disk unlocked, bypassing secure boot protections and leaving TPM PCR values unchanged.

An attacker with physical access can gain unauthorized root access to the device by bypassing secure boot protections. This allows full control over the system with the disk unlocked, potentially compromising system integrity and confidentiality. The TPM PCR values remain unaltered, which may prevent detection of the compromise through TPM-based integrity checks.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict physical access to affected devices to mitigate exploitation risk.