A physical access vulnerability in IncusOS allows attackers to bypass LUKS disk encryption and access protected data, necessitating an immediate update to the hardened configuration.

This vulnerability is caused by an insufficiently protected credential configuration where the TPM releases the LUKS encryption key based on overly permissive PCR11 policies. An unauthenticated attacker with physical access can perform a filesystem substitution attack to intercept the key and gain unauthorized access to the system.

The ability to bypass disk encryption poses a severe risk to data confidentiality and integrity, as attackers can exfiltrate sensitive information or modify the operating system state. With a CVSS score of 7.6, this flaw represents a significant security risk for environments where physical security of the hardware cannot be guaranteed, potentially leading to total system compromise.

Immediate Action: Update to the patched version of IncusOS (202603142010 or later) which corrects the systemd-cryptenroll configuration.

Proactive Monitoring: Monitor physical access logs and implement tamper-evident hardware measures to identify unauthorized physical interactions with sensitive systems.

Compensating Controls: Ensure that full-disk encryption policies are strictly enforced and utilize hardware security modules that require additional user authentication beyond TPM-based unlocking where possible.

Public Exploit Available: Yes — a proof-of-concept repository exists on GitHub (github.com/gibmat/CVE-2026-32606-POC).

The severity of this vulnerability is elevated by the presence of a public proof-of-concept and the potential for complete data exposure. Administrators must prioritize updating IncusOS to the specified fixed version to restrict the TPM's ability to release encryption keys to unauthorized boot environments. Failure to address this flaw leaves protected data vulnerable to physical bypass attacks.