CVE-2026-104618

MEDIUM 6.2

sdbootutil: world-readable debug log

CVSS Score

6.2

EPSS Score

0.0%

EPSS Percentile

0th

On request the `sdbootutil` script creates a world-readable debug log in /var/log/sdbootutil.log. The log file is created world-readable, however, which means that arbitrary low-privileged users in the system will be able to extract secrets from it.

CWE	CWE-732
Vendor	suse
Product	suse linux enterprise server 16.1
Published	Oct 15, 2026

Stay Ahead of the Next One

Get instant alerts for suse suse linux enterprise server 16.1

Be the first to know when new medium vulnerabilities affecting suse suse linux enterprise server 16.1 are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Affected Versions

SUSE / SUSE Linux Enterprise Server 16.1

SUSE / SUSE Linux Enterprise Server for NVIDIA 16.1

SUSE / openSUSE Leap 16.1

openSUSE / Tumbleweed

? < 278458aeb7d8f995c0e3dc9d19d2dcba50795a42

References

NVD ↗ CVE.org ↗ EPSS Data ↗

bugzilla.suse.com: https://bugzilla.suse.com/show_bug.cgi?id=CVE-2026-104618 suse.com: https://www.suse.com/security/cve/CVE-2026-104618.html

Credits

Matthias Gerstner of SUSE