Vulnerability · Published May 27, 2026 · Assigned by GitHub_M

CVE-2026-47274pam_usb: Uncontrolled search path in pam_usb tools allows privilege escalation via PATH manipulation

Medium 6.3

In plain English

A medium-severity uncontrolled search path in pam_usb from mcdope. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 3% of all known vulnerabilities).

Severity (CVSS 3.1)6.3Medium

Exploit odds (30 days)0.1%top 96.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

pam_usb provides hardware authentication for Linux using ordinary removable media. Prior to 0.9.0, multiple pam_usb helper tools resolved external binaries through the PATH environment variable rather than using absolute paths. An attacker who can influence the process environment during PAM authentication or tool execution could substitute malicious binaries. The affected tools are pamusb-check (src/tmux.c), pamusb-conf (tools/pamusb-conf), and pamusb-keyring-unlock-gnome (tools/pamusb-keyring-unlock-gnome). This vulnerability is fixed in 0.9.0.

Affected products (as reported)

Vendor	Product	Versions
mcdope	pam_usb	< 0.9.0

Weakness: CWE-427 · Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

References

https://github.com/mcdope/pam_usb/security/advisories/GHSA-pp29-w28g-r9h9 x_refsource_CONFIRM
https://github.com/mcdope/pam_usb/commit/1ee8745920388df48d001a8e61ba629071557937 x_refsource_MISC
https://github.com/mcdope/pam_usb/commit/52a1fd6413b7ffcc1a5b58ce432be42e7bf0dbd0 x_refsource_MISC
https://github.com/mcdope/pam_usb/commit/993e73d8bebb1d8e62677388de3402b6ec36b600 x_refsource_MISC