CVE-2026-104617

CVE-2026-104617 · sdbootutil: qrencode invocation leaks PIN/recovery key in /proc/<pid>/cmdline

This page contains facts from public vulnerability sources. Check the original advisory before updating.

There are two invocations of `qrencode` to display a QR code for scanning. These invocations leak the private data $pin / $key via /proc accessible for arbitrary low-privileged users in the system.

CVSS 5.9 · Medium · EPSS 0.1%

Published

2026-10-15T08:33:09.363Z

Updated

2026-10-15T14:03:20.369Z

Check your server →