CVE-2026-104617: CWE-522: Insufficiently protected credentials in SUSE SUSE Linux Enterprise Server 16.1

The vulnerability involves two calls to the qrencode utility that display QR codes for scanning. These calls inadvertently expose private data variables ($pin and $key) through the /proc filesystem, which is accessible to arbitrary low-privileged users on the system. This constitutes insufficient protection of credentials (CWE-522). The CVSS 3.1 vector indicates local attack vector (AV:L), high attack complexity (AC:H), no privileges required (PR:N), no user interaction (UI:N), unchanged scope (S:U), high confidentiality impact (C:H), no integrity or availability impact (I:N/A:N).

Confidentiality of sensitive credentials ($pin and $key) is compromised because low-privileged users can access these via the /proc filesystem. There is no impact on integrity or availability. The attack requires local access and has high complexity, limiting exploitability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Until a patch is available, restrict access to the /proc filesystem where possible and limit local user privileges to reduce exposure.