CVE-2026-104617 in Suse and OpenSuse Products
Published on October 15, 2026

sdbootutil: qrencode invocation leaks PIN/recovery key in /proc/<pid>/cmdline

There are two invocations of `qrencode` to display a QR code for scanning. These invocations leak the private data $pin / $key via /proc accessible for arbitrary low-privileged users in the system.

NVD

Vulnerability Analysis

CVE-2026-104617 can be exploited with local system access, and does not require authorization privileges or user interaction. This vulnerability is consided to have a high level of attack complexity. The potential impact of an exploit of this vulnerability is considered to have a high impact on confidentiality, with no impact on integrity and availability.

Exploitation:

NONE

Automatable:

NO

Technical Impact:

PARTIAL

Attack Vector:

LOCAL

Attack Complexity:

HIGH

Privileges Required:

NONE

User Interaction:

NONE

Scope:

UNCHANGED

Confidentiality Impact:

HIGH

Integrity Impact:

NONE

Availability Impact:

NONE

Weakness Type

Insufficiently Protected Credentials

The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.

Products Associated with CVE-2026-104617

stack.watch emails you whenever new vulnerabilities are published in Suse Linux Enterprise Server or OpenSuse Tumbleweed. Just hit a watch button to start following.

Suse Linux Enterprise Server

  Watch

OpenSuse Tumbleweed

  Watch

Affected Versions

• Version ? is affected.

• Version ? is affected.

• Version ? is affected.

• Version ? and below 947e9dc09ce7c36b35a868e397e30245cc5544a1 is affected.