CVE-2026-47274 Details
Description
pam_usb provides hardware authentication for Linux using ordinary removable media. Prior to 0.9.0, multiple pam_usb helper tools resolved external binaries through the PATH environment variable rather than using absolute paths. An attacker who can influence the process environment during PAM authentication or tool execution could substitute malicious binaries. The affected tools are pamusb-check (src/tmux.c), pamusb-conf (tools/pamusb-conf), and pamusb-keyring-unlock-gnome (tools/pamusb-keyring-unlock-gnome). This vulnerability is fixed in 0.9.0.
A vulnerability in pam_usb helper tools prior to version 0.9.0 allows for privilege escalation through uncontrolled search paths. The affected tools, pamusb-check, pamusb-conf, and pamusb-keyring-unlock-gnome, resolved external binaries via the PATH environment variable instead of using absolute paths. This flaw could be exploited by an attacker who can manipulate the process environment during PAM authentication or tool execution, potentially leading to the execution of malicious binaries.
Users should update to pam_usb version 0.9.0 or later, where this vulnerability has been fixed by ensuring all external binary invocations use absolute paths. Additionally, the keyring password file is now read as data rather than sourced as shell code, and the password is passed to gnome-keyring-daemon via stdin, avoiding exposure in the process list.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 27, 2026CISA-ADP
Assessed May 30, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-427 | Uncontrolled Search Path Element | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| pam_usb | <= 0.8.6 (semver) |
CPE
Remediation
| |
| pam_usb pamusb-check | All versions |
CPE
Remediation
| |
| pam_usb pamusb-conf | All versions |
CPE
Remediation
| |
| pam_usb pamusb-keyring-unlock-gnome | All versions |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 27, 2026 | New CVE Received | [email protected] |