CVE-2026-104618

No fix known EPSS <1%CVSS 6.2

On request the `sdbootutil` script creates a world-readable debug log in /var/log/sdbootutil.log. The log file is created world-readable, however, which means that arbitrary low-privileged users in the system will be able to extract secrets from it.

Published 2026-10-15 · CVE record · OSV

Products: SUSE Linux Enterprise Server 16.1, SUSE Linux Enterprise Server for NVIDIA 16.1, openSUSE Leap 16.1, opensuse tumbleweed