Critical TPM Flaw in HP ThinPro Exposes Disk-Encryption Keys
Security researcher Darren McDonald has uncovered a critical design flaw in HP ThinPro versions 8 and 9 that allows attackers with physical access to extract TPM-sealed LUKS disk-encryption keys. The vulnerability stems from an incomplete measured-boot policy, which validates the GRUB bootloader but fails to measure the Linux kernel and initramfs, leaving the system exposed to tampering.
The flaw affects HP t530 and t540 thin clients running ThinPro, which store the OS on a LUKS2-encrypted Btrfs partition protected by a TPM-sealed key. While the TPM policy checks PCRs 0, 2, and 4 covering firmware, option ROMs, and GRUB it does not account for the Secure Boot state, GRUB configuration, Linux kernel, or initramfs. This oversight enables attackers to modify unmeasured boot components, such as the unseal_key initramfs script, without triggering TPM policy violations.
By altering the script, an attacker can intercept the LUKS key during boot, copy it to an unencrypted partition, and later use it to unlock the encrypted drive. The attack is low-complexity, requiring no privileges or user interaction, and leaves no immediate signs of compromise. Once extracted, the key grants access to configuration data, credential stores, and password hashes for local accounts.
The vulnerability has been confirmed on:
- HP t530 (ThinPro 8.1.0 build 22)
- HP t540 (ThinPro 9.0.0 build 15)
McDonald assigned the flaw a CVSS v3.1 score of 6.1 (Medium), noting that while physical access is required, the impact includes high confidentiality and integrity risks. HP’s Product Security Incident Response Team (PSIRT) was notified on February 22, 2026, and has acknowledged the issue, though no patch or CVE has been released as of August 8.
Until a fix is deployed, organizations are advised that ThinPro’s full-disk encryption may not protect data once devices leave physical control. Secure disposal of storage media is recommended to mitigate risks.
Source: https://gbhackers.com/hp-thinpro-tpm-flaw/
HPE cybersecurity rating report: https://www.rankiteo.com/company/hpe
"id": "HPE1786359897",
"linkid": "hpe",
"type": "Vulnerability",
"date": "2/2026",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"{'affected_entities': [{'industry': 'Technology (Hardware/Thin Clients)',
'name': 'HP',
'type': 'Corporation'}],
'attack_vector': 'Physical Access',
'customer_advisories': 'HP ThinPro users advised that full-disk encryption '
'may not protect data once devices leave physical '
'control. Secure disposal of storage media is '
'recommended.',
'data_breach': {'data_encryption': 'LUKS2-encrypted Btrfs partition '
'(compromised due to flaw)',
'data_exfiltration': 'Possible if attacker copies keys to '
'unencrypted partition',
'personally_identifiable_information': 'Password hashes for '
'local accounts',
'sensitivity_of_data': 'High (LUKS encryption keys, password '
'hashes)',
'type_of_data_compromised': 'Disk-encryption keys, '
'configuration data, credential '
'stores, password hashes'},
'date_detected': '2026-02-22',
'date_publicly_disclosed': '2026-08-08',
'description': 'Security researcher Darren McDonald has uncovered a critical '
'design flaw in HP ThinPro versions 8 and 9 that allows '
'attackers with physical access to extract TPM-sealed LUKS '
'disk-encryption keys. The vulnerability stems from an '
'incomplete measured-boot policy, which validates the GRUB '
'bootloader but fails to measure the Linux kernel and '
'initramfs, leaving the system exposed to tampering.',
'impact': {'brand_reputation_impact': 'High (HP ThinPro security flaw)',
'data_compromised': 'LUKS disk-encryption keys, configuration '
'data, credential stores, password hashes for '
'local accounts',
'identity_theft_risk': 'High (access to password hashes and '
'credential stores)',
'operational_impact': 'Potential unauthorized access to encrypted '
'data',
'systems_affected': 'HP t530 and t540 thin clients running ThinPro '
'8 and 9'},
'investigation_status': 'Acknowledged by HP PSIRT; no patch or CVE released '
'as of August 8, 2026',
'lessons_learned': 'Incomplete measured-boot policies can undermine TPM-based '
'disk encryption, even with physical access controls. '
'Secure disposal of storage media is critical for '
'mitigating risks in unpatched systems.',
'post_incident_analysis': {'corrective_actions': 'HP to release patch to '
'enforce full measured-boot '
'validation for all critical '
'boot components.',
'root_causes': 'Incomplete measured-boot policy in '
'HP ThinPro (failure to measure '
'Linux kernel and initramfs, Secure '
'Boot state, and GRUB '
'configuration)'},
'recommendations': '1. Apply HP ThinPro patches once available. 2. Implement '
'secure disposal procedures for storage media in affected '
'devices. 3. Monitor for unauthorized access to encrypted '
'data. 4. Review measured-boot policies to ensure all '
'critical boot components are validated.',
'references': [{'date_accessed': '2026-08-08',
'source': 'Darren McDonald (Security Researcher)'}],
'response': {'remediation_measures': 'Secure disposal of storage media '
'recommended until patch is deployed'},
'title': 'Critical TPM Flaw in HP ThinPro Exposes Disk-Encryption Keys',
'type': 'Vulnerability Exploitation',
'vulnerability_exploited': 'Incomplete measured-boot policy in HP ThinPro '
'(failure to measure Linux kernel and initramfs)'}