CVE-2026-104618: sdbootutil: world-readable debug log
Published Oct 15, 2026
·Updated
On request the sdbootutil script creates a world-readable debug log in /var/log/sdbootutil.log. The log file is created world-readable, however, which means that arbitrary low-privileged users in the system will be able to extract secrets from it.
Affected Software
1 affected component
systemd sdbootutil
Event History
Oct 15, 2026
CVE Published
via MITRE·08:41 AM
Data Sourced
via MITRE·08:41 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Who can access sensitive information exposed by this issue?
Any low-privileged local user on the system can read the debug log after it is created, potentially exposing secrets recorded in that log.
2
What must occur for the vulnerable log file to be created?
The sdbootutil script creates the debug log on request. Exploitation requires that a debug log be generated at /var/log/sdbootutil.log.
3
How can administrators check whether a system may already be affected?
Check for the presence of /var/log/sdbootutil.log and review its permissions. A world-readable instance may be accessible to arbitrary local users and should be treated as potentially containing exposed secrets.