---
id: CVE-2026-104617
title: There are two invocations of `qrencode` to display a QR code for scanning
summary: >-
  There are two invocations of `qrencode` to display a QR code for scanning.
  These invocations leak the private data $pin / $key via /proc accessible for
  arbitrary low-privileged users in the system.
severity: medium
cvss: 5.1
cvssVector: 'CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N'
cwe:
  - CWE-522
vendor: SUSE
product: sdbootutil
affected:
  - sdbootutil ?
  - sdbootutil ?
  - sdbootutil ?
  - sdbootutil >= ? < 947e9dc09ce7c36b35a868e397e30245cc5544a1
published: '2026-10-15'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T09:17:16.113'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-104617'
references:
  - url: 'https://bugzilla.suse.com/show_bug.cgi?id=CVE-2026-104617'
    label: meissner@suse.de
  - url: 'https://www.suse.com/security/cve/CVE-2026-104617.html'
    label: meissner@suse.de
tags:
  - nvd
  - cve.org
ingestedAt: '2026-10-15T08:58:33.094Z'
---

## Overview

There are two invocations of `qrencode` to display a QR code for scanning. These invocations leak the private data $pin / $key via /proc accessible for arbitrary low-privileged users in the system.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.