CVE-2026-104617 — sdbootutil: qrencode invocation leaks PIN/recovery key in /proc/<pid>/cmdline
There are two invocations of `qrencode` to display a QR code for scanning. These invocations leak the private data $pin / $key via /proc accessible for arbitrary low-privileged …
Published: 2026-10-15 · CVSS: 5.9 · CVSS 4.0
There are two invocations of `qrencode` to display a QR code for scanning. These invocations leak the private data $pin / $key via /proc accessible for arbitrary low-privileged users in the system.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7