The bomber was sucked out of the plane through the one-metre wide hole when the blast ripped open the pressurised cabin in mid-air, officials said.
The pilot landed the plane in the Somali capital, from where it had taken off.
No group has so far taken responsibility for the attack, but a US government source last week said the United States suspects Islamist militant group al Shabaab, which is aligned to al Qaeda, was responsible for the blast.
Mohamed Yassin, Daallo Airlines chief executive, said most of the passengers who were on the bombed flight were scheduled to fly with Turkish Airlines, but were ferried to Djibouti by one of his planes after the Turkish carrier cancelled its flight, citing bad weather.
“That particular passenger (who was behind the blast) boarded the aircraft on a Turkish Airlines boarding pass and was on the list for the Turkish Airlines manifest,” Yassin told Reuters by telephone from Dubai.
Somalia, mired in conflict since civil war broke out in 1991, has few air links outside East Africa.
In 2012, Turkish Airlines became the first major international commercial airline to fly out of Somalia in more than two decades.
Mogadishu’s heavily guarded airport has several safety perimeter fences and checkpoints. It houses a large UN compound along with several Western embassies.
Somali officials said an investigation had been launched and arrests made, including airport workers.
CCTV footage released by the Somali National Intelligence Agency (NISA) appears to show two airport workers inside the terminal handing the suicide bomber a laptop stuffed with explosives, according to the government spokesman.