SUSE Linux Enterprise EUVD-2026-101943

Exploitation requires that the vulnerable SUSE workflow invoke qrencode with the secret ($pin/$key) passed as a command-line argument, which exposes it in /proc/<pid>/cmdline. The attacker must already have a local low-privileged account on the same host (AV:L) and must read /proc during the short window while the qrencode process is executing, making this a timing race (AC:H). Limiting factors: no remote access path, confidentiality-only impact (no integrity/availability effect), and relevance largely confined to multi-user systems where untrusted local users share the host with the secret-generating process; single-user or tightly controlled hosts have little realistic exposure.

This is a genuine but modest-severity local credential-exposure issue, not a top-tier priority. The input CVSS 4.0 vector (AV:L/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N) and CWE-522 (Insufficiently Protected Credentials) are internally consistent with the description: secrets ($pin/$key) are passed as command-line arguments to qrencode and therefore become readable via /proc/<pid>/cmdline by other local users. Confidentiality impact is High but there is no integrity or availability impact, and the attack vector is Local with High attack complexity - the attacker must win a timing race against the short-lived qrencode process. No EPSS score, KEV listing, or public POC is present in the supplied data, so by the precision rules this is 'no public exploit identified at time of analysis'; it is neither confirmed exploited nor known-weaponized. CONFLICT TO NOTE: the input Tags include 'RCE', which contradicts the description, CWE-522, and the VC:H/VI:N/VA:N vector - this is a credential-disclosure bug, not remote code execution, and the RCE tag appears mislabeled. Net: a low-urgency, defense-in-depth fix most relevant to multi-user systems where untrusted local accounts coexist with the secret-handling workflow.

On a shared SUSE/openSUSE system, a privileged setup or enrollment workflow invokes qrencode with a PIN or key passed as a command-line argument to render a scannable QR code. A separate low-privileged local user polls /proc/<pid>/cmdline during that brief execution window and reads the secret out of the process arguments. No public exploit code is identified; exploitation is a simple /proc read but requires catching the process while it runs (AC:H).