World-Readable Debug Log Vulnerability in SUSE Products
CVE-2026-104618

6.9MEDIUM

Key Information:

Vendor

Suse
Status
Suse Linux Enterprise Server 16.1
Suse Linux Enterprise Server For Nvidia 16.1
Opensuse Leap 16.1
Tumbleweed
Vendor
CVE Published:
15 October 2026

What is CVE-2026-104618?

The sdbootutil script in SUSE products generates a debug log located at /var/log/sdbootutil.log with world-readable permissions. This configuration allows unauthorized, low-privileged users to access sensitive information contained within the log file. Such exposure may lead to the compromise of system secrets and pose a significant risk to the overall security of affected systems. It is crucial for administrators to review and adjust the file permissions to mitigate this risk and protect sensitive data.

Affected Version(s)

openSUSE Leap 16.1 ?

SUSE Linux Enterprise Server 16.1 ?

SUSE Linux Enterprise Server for NVIDIA 16.1 ?

References

https://bugzilla.suse.com/show_bug.cgi?id=CVE-2026-104618
https://www.suse.com/security/cve/CVE-2026-104618.html

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Matthias Gerstner of SUSE
.