All vulnerabilities
CVE-2026-104617

SUSE Linux Enterprise Server 16.1: sdbootutil: qrencode invocation leaks PIN/recovery key in /proc/<pid>/cmdline

SUSE SUSE Linux Enterprise Server 16.1
Open in ThreatlineRecord JSON
CVSS
5.1Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.10%Chance of exploitation activity in the next 30 days, higher than 0% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in947e9dc09ce7c36b35a868e397e30245cc5544a1Fixed versionCVE List
Published15 Oct 2026Updated 15 Oct 2026CVE List

What fixes it

  • 947e9dc09ce7c36b35a868e397e30245cc5544a1TumbleweedCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

There are two invocations of qrencode to display a QR code for scanning. These invocations leak the private data $pin / $key via /proc accessible for arbitrary low-privileged users in the system.

Text from CVE List

Affected versions 4

  • SUSE Linux Enterprise Server 16.1affected: ?CVE List
  • SUSE Linux Enterprise Server for NVIDIA 16.1affected: ?CVE List
  • openSUSE Leap 16.1affected: ?CVE List
  • Tumbleweedaffected: ? before 947e9dc09ce7c36b35a868e397e30245cc5544a1CVE List

References 2