CVE-2026-104617: sdbootutil: qrencode invocation leaks PIN/recovery key in /proc/<pid>/cmdline
Published Oct 15, 2026
·Updated
There are two invocations of qrencode to display a QR code for scanning. These invocations leak the private data $pin / $key via /proc accessible for arbitrary low-privileged users in the system.
Affected Software
1 affected component
systemd sdbootutil
Event History
Oct 15, 2026
CVE Published
via MITRE·08:33 AM
Data Sourced
via MITRE·08:33 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Who can access the leaked data?
Arbitrary low-privileged users on the same system can read the PIN or recovery key from the qrencode process command line via /proc/<pid>/cmdline while the relevant qrencode invocation is running.
2
What does an attacker need to exploit this issue?
The attacker needs local access to the affected system and must observe the qrencode process command line during one of the two QR-code display invocations. No privileges or user interaction are required according to the supplied vector.