All vulnerabilities
CVE-2026-104618

SUSE Linux Enterprise Server 16.1: sdbootutil: world-readable debug log

SUSE SUSE Linux Enterprise Server 16.1
Open in ThreatlineRecord JSON
CVSS
6.2Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.11%Chance of exploitation activity in the next 30 days, higher than 1% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in278458aeb7d8f995c0e3dc9d19d2dcba50795a42Fixed versionCVE List
Published15 Oct 2026Updated 15 Oct 2026CVE List

What fixes it

  • 278458aeb7d8f995c0e3dc9d19d2dcba50795a42TumbleweedCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

On request the sdbootutil script creates a world-readable debug log in /var/log/sdbootutil.log. The log file is created world-readable, however, which means that arbitrary low-privileged users in the system will be able to extract secrets from it.

Text from CVE List

Affected versions 4

  • SUSE Linux Enterprise Server 16.1affected: ?CVE List
  • SUSE Linux Enterprise Server for NVIDIA 16.1affected: ?CVE List
  • openSUSE Leap 16.1affected: ?CVE List
  • Tumbleweedaffected: ? before 278458aeb7d8f995c0e3dc9d19d2dcba50795a42CVE List

References 2