{"id":"CVE-2026-104617","title":"There are two invocations of `qrencode` to display a QR code for scanning","summary":"There are two invocations of `qrencode` to display a QR code for scanning. These invocations leak the private data $pin / $key via /proc accessible for arbitrary low-privileged users in the system.","severity":"medium","cvss":5.1,"cvssVector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","cwe":["CWE-522"],"vendor":"SUSE","product":"sdbootutil","affected":["sdbootutil ?","sdbootutil ?","sdbootutil ?","sdbootutil >= ? < 947e9dc09ce7c36b35a868e397e30245cc5544a1"],"published":"2026-10-15","updated":"2026-10-15","sourceUpdated":"2026-10-15T09:17:16.113","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-104617","references":[{"url":"https://bugzilla.suse.com/show_bug.cgi?id=CVE-2026-104617","label":"meissner@suse.de"},{"url":"https://www.suse.com/security/cve/CVE-2026-104617.html","label":"meissner@suse.de"}],"tags":["nvd","cve.org"],"ingestedAt":"2026-10-15T08:58:33.094Z","slug":"CVE-2026-104617","body":"## Overview\n\nThere are two invocations of `qrencode` to display a QR code for scanning. These invocations leak the private data $pin / $key via /proc accessible for arbitrary low-privileged users in the system.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":28,"depthScoreParts":{"impact":28.1,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}