Is CVE-2026-104618 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-104618 being exploited in the wild.

How severe is CVE-2026-104618?

Medium severity, with a CVSS score of 6.2, published 15 October 2026.

Which products and versions are affected?

Opensuse Leap 16.1; Suse Linux Enterprise Server 16.1, 16.2; SUSE Linux Enterprise Server for NVIDIA 16.1; SUSE Linux Enterprise Server for SAP applications 16.2.

Is there a fix for CVE-2026-104618?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-104618 attacked?

It is attacked with local access, in an operating system.

Am I affected by CVE-2026-104618?

Check whether you run Opensuse Leap, Suse Linux Enterprise Server, SUSE Linux Enterprise Server for NVIDIA or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-104618: sdbootutil world-readable debug log credential exposure

CVE-2026-104618 · Severity: medium · CVSS 6.2 · Published 2026-10-15

The sdbootutil script creates a world-readable debug log file that can be accessed by any low-privileged user on the system. An attacker with local access can read this log to extract sensitive credentials and other secrets stored within it, potentially enabling privilege escalation or lateral movement.

Technologies: Opensuse Leap, Suse Linux Enterprise Server. Vendors: Opensuse, Suse.

Quick answers

Is CVE-2026-104618 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-104618 being exploited in the wild.
How severe is CVE-2026-104618?: Medium severity, with a CVSS score of 6.2, published 15 October 2026.
Which products and versions are affected?: Opensuse Leap 16.1; Suse Linux Enterprise Server 16.1, 16.2; SUSE Linux Enterprise Server for NVIDIA 16.1; SUSE Linux Enterprise Server for SAP applications 16.2.
Is there a fix for CVE-2026-104618?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-104618 attacked?: It is attacked with local access, in an operating system.
Am I affected by CVE-2026-104618?: Check whether you run Opensuse Leap, Suse Linux Enterprise Server, SUSE Linux Enterprise Server for NVIDIA or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The sdbootutil script creates a debug log at /var/log/sdbootutil.log with world-readable permissions (mode 0644), allowing any local user to read it without privilege. The log file contains sensitive information including credentials and secrets. An attacker with local system access can read this file to extract these secrets, resulting in information disclosure. A fix is currently pending.

Affected products

SUSE Linux Enterprise Server 16.1, 16.2
SUSE Linux Enterprise Server for NVIDIA 16.1
SUSE Linux Enterprise Server for SAP applications 16.2
openSUSE Leap 16.1

Timeline

2026-10-15: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.