SUSE sdbootutil: Information exposure through world-readable debug log
Summary
The sdbootutil script of SUSE Linux Enterprise Server, openSUSE Leap and openSUSE Tumbleweed creates a debug log at /var/log/sdbootutil.log that is world-readable when it is requested. Any local user with a low-privileged account can read the log and may extract secrets from it. The attacker needs local access and the log must have been created, so the exposure is limited to affected hosts with the systemd-boot setup.
Affected
- SUSE Linux Enterprise Server 16.1 (versions unknown)
- SUSE Linux Enterprise Server for NVIDIA 16.1 (versions unknown)
- openSUSE Leap 16.1 (versions unknown)
- openSUSE Tumbleweed before commit 278458aeb7d8f995c0e3dc9d19d2dcba50795a42 (per CNA record; range not confirmed)
Fixed in
Unknown.
Workaround
- Restrict execution of sdbootutil to privileged accounts or disable the script until a fix is installed (per a third-party mirror of the CVE record; not confirmed by the vendor).
- Check whether /var/log/sdbootutil.log exists and restrict it to root, for example with mode 0600 owned by root.
- Delete the log file after troubleshooting is complete.
Exploitation
- CISA SSVC: exploitation none, automatable no, technical impact partial.
- Not listed in CISA KEV.
- No public proof of concept or reports of in-the-wild exploitation found.
Our recommendation
- Inventory SUSE and openSUSE hosts with sdbootutil installed.
- Check for /var/log/sdbootutil.log and its permissions, and check whether it contains credentials or key material.
- Apply the vendor update as soon as the fixed package version is confirmed in the SUSE CVE page or the Bugzilla entry.
- Limit shell access on multi-user systems.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- SUSE CVE page CVE-2026-104618 www.suse.com
- SUSE Bugzilla entry CVE-2026-104618 bugzilla.suse.com
- OpenCVE CVE-2026-104618 app.opencve.io
- VulDB entry 420556 vuldb.com
- Vulners NVD CVE-2026-104618 vulners.com
- openSUSE changelog mail archive mail-archive.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 4 Nov 2026, 14:58.
Original description (NVD)
On request the `sdbootutil` script creates a world-readable debug log in /var/log/sdbootutil.log. The log file is created world-readable, however, which means that arbitrary low-privileged users in the system will be able to extract secrets from it.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.