Skip to content
CVE PROGRAM SOURCE RECORD5.9 Medium

CVE-2026-104617

sdbootutil: qrencode invocation leaks PIN/recovery key in /proc/<pid>/cmdline

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
suse

Description

There are two invocations of `qrencode` to display a QR code for scanning. These invocations leak the private data $pin / $key via /proc accessible for arbitrary low-privileged users in the system.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

SUSE SUSE Linux Enterprise Server 16.1

Default version status: affected

  • ?affected

SUSE SUSE Linux Enterprise Server for NVIDIA 16.1

Default version status: affected

  • ?affected

SUSE openSUSE Leap 16.1

Default version status: affected

  • ?affected

openSUSE Tumbleweed

Default version status: affected

  • ? to < 947e9dc09ce7c36b35a868e397e30245cc5544a1affected

References