# CVE-2026-104617: SUSE sdbootutil credential exposure via qrencode /proc

Source: https://junglewise.ai/threats/cve-2026-104617-there-are-two-invocations-of-qrencode-to-display-a-qr-code-for  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-15. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-104617 · Severity: medium · CVSS 5.1 · Published 2026-10-15

sdbootutil is a system utility used to manage boot configurations on SUSE Linux servers. When displaying QR codes for scanning, the tool leaks sensitive credentials (PINs and encryption keys) through the /proc filesystem, where any unprivileged user on the system can read them. This allows local attackers to obtain authentication secrets without elevated privileges.

Technologies: [Opensuse Leap](https://junglewise.ai/threats/technologies/leap), [SUSE Linux Enterprise Server](https://junglewise.ai/threats/technologies/linux-enterprise-server). Vendors: [Opensuse](https://junglewise.ai/threats/vendors/opensuse), [Suse](https://junglewise.ai/threats/vendors/suse).

## Quick answers

**Is CVE-2026-104617 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-104617 being exploited in the wild.

**How severe is CVE-2026-104617?** Medium severity, with a CVSS score of 5.1, published 15 October 2026.

**Which products and versions are affected?** Opensuse Leap 16.1; SUSE Linux Enterprise Server 16.1, 16.2; SUSE Linux Enterprise Server for NVIDIA 16.1; SUSE Linux Enterprise Server for SAP applications 16.2.

**Is there a fix for CVE-2026-104617?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-104617 attacked?** It is attacked with local access, in an operating system.

**Am I affected by CVE-2026-104617?** Check whether you run Opensuse Leap, Suse Sdbootutil, SUSE Linux Enterprise Server or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The qrencode invocations in sdbootutil pass private credentials ($pin and $key) as command-line arguments, which are exposed in /proc/[pid]/cmdline and readable by all system users. An attacker with local access can examine process arguments of running qrencode instances to extract sensitive authentication material. This is a local information disclosure vulnerability requiring no privileges but occurring only when QR code display is triggered.

## Affected products

- SUSE sdbootutil
- SUSE SUSE Linux Enterprise Server 16.1, 16.2
- SUSE SUSE Linux Enterprise Server for NVIDIA 16.1
- SUSE SUSE Linux Enterprise Server for SAP applications 16.2
- openSUSE Leap 16.1

## Timeline

- 2026-10-15: disclosed: CVE published

## References

- [https://bugzilla.suse.com/show_bug.cgi?id=CVE-2026-104617](https://bugzilla.suse.com/show_bug.cgi?id=CVE-2026-104617)
- [https://www.suse.com/security/cve/CVE-2026-104617.html](https://www.suse.com/security/cve/CVE-2026-104617.html)

## Related threats

- [sdbootutil world-readable debug log credential exposure](https://junglewise.ai/threats/cve-2026-104618-on-request-the-sdbootutil-script-creates-a-world-readable-debug)
- [openSUSE wicked command injection via unsanitized DHCP options](https://junglewise.ai/threats/cve-2026-44932-opensuse-wicked-command-injection-via-unsanitized-dhcp-options)
- [OpenSSH privilege escalation in AuthorizedKeysCommand helper programs](https://junglewise.ai/threats/cve-2021-41617-openssh-privilege-escalation-in-authorizedkeyscommand-helper)
- [Tats w3m uninitialized value in parsetagx.c](https://junglewise.ai/threats/cve-2016-9436-tats-w3m-uninitialized-value-in-parsetagx-c)
- [w3m uninitialized value use in HTMLtagproc1](https://junglewise.ai/threats/cve-2016-9435-w3m-uninitialized-value-use-in-htmltagproc1)