Reported by 2 outlets

Timeline

1. original reporting

   HP ThinPro TPM Flaw Lets Attackers Strip LUKS Disk-Encryption Keys With Physical Access

   gbhackers.com · 65d ago · August 10th, 2026

   A design flaw in HP ThinPro 8 and 9 (confirmed on t530/t540 models) defeats TPM-sealed full-disk encryption: the measured-boot policy validates only PCRs 0, 2, and 4 — firmware, option ROMs, and the GRUB binary — but not the Linux kernel or initramfs, which live on an unencrypted BOOT partition. An attacker can modify the initramfs unseal_key script to copy the TPM-released LUKS key to the unencrypted partition during boot; the TPM detects no policy mismatch and releases the secret, exposing config data, credential stores, and password hashes. Rated CVSS 6.1 with no privileges or user interaction required; HP was notified February 22 and a fix is in QA, but no CVE or bulletin exists as of August 8. Treat ThinPro FDE as inadequate once a device leaves your physical control and destroy storage media at disposal.

2. update from gbhackers.com

   HP ThinPro TPM Flaw Lets Attackers Bypass Full Disk Encryption and Steal LUKS Keys

   gbhackers.com · 64d ago · August 10th, 2026

   A security researcher has revealed a critical design flaw in HP ThinPro versions 8 and 9, which allows attackers with physical access to a thin client’s storage drive to extract TPM-sealed LUKS disk-encryption keys. This vulnerability arises from an incomplete measured-boot policy that validates the GRUB bootloader but fails to measure the Linux kernel and […] The post HP ThinPro TPM Flaw Lets Attackers Bypass Full Disk Encryption and Steal LUKS Keys appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .

3. update from cyberpress.org

   HP ThinPro TPM Flaw Lets Physical Attackers Extract LUKS Disk Encryption Keys

   cyberpress.org · 64d ago · August 10th, 2026

   HP ThinPro’s TPM-backed disk encryption can be bypassed by a physical attacker who modifies unencrypted boot files, allowing extraction of the LUKS key protecting device data. Researcher Darren McDonald said the issue affects ThinPro 8 and 9 deployments on HP thin clients, undermining the assumption that a TPM seal alone protects a removed or stolen drive against offline access attacks. The flaw stems from incomplete boot chain measurement. ThinPro stores its operating system on a LUKS2-encrypted btrfs partition and uses a custom utility, hptc-tpm-tool , to seal the disk key within the Trusted Platform Module. During startup, an initramfs key script requests the TPM released key and supplies it directly to cryptsetup , ordinarily avoiding storage of the secret on disk. Those registers measure BIOS firmware , option ROMs or UEFI drivers, and the GRUB binary. They do not measure GRUB configuration commands, the Secure Boot state, the Linux kernel, the initramfs image, or scripts loaded by the bootloader after GRUB has launched. That omission gives an attacker with physical access a way to replace or alter the initramfs without changing the measured PCR values. McDonald found that the unseal_key script within the initramfs can be modified so that, once the TPM releases the LUKS key, it writes a copy to the unencrypted BOOT partition before continuing the normal decryption proces