PT-2026-44087 · Pam Usb · Pam Usb

Mcdope · CVE-2026-47274 · Published 2026-05-27 · Updated 2026-05-27

Positive Technologies (AI Summary)

CVSS v3.1

6.3

Medium

Base vector

AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions pam usb versions prior to 0.9.0

Description Multiple helper tools in pam usb resolve external binaries using the PATH environment variable instead of absolute paths. An attacker capable of influencing the process environment during PAM authentication or tool execution could substitute legitimate binaries with malicious ones. The affected tools include pamusb-check (src/tmux.c), pamusb-conf (tools/pamusb-conf), and pamusb-keyring-unlock-gnome (tools/pamusb-keyring-unlock-gnome).

Recommendations Update to version 0.9.0.

Exploit

Fix

LPE

Uncontrolled Search Path Element

Weakness Enumeration

CWE-427

Related Identifiers

CVE-2026-47274

GHSA-PP29-W28G-R9H9

Affected Products

Pam Usb

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/47xxx/CVE-2026-47274.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-47274 · Security Note
• https://osv.dev/vulnerability/CVE-2026-47274 · Vendor Advisory
• https://github.com/mcdope/pam_usb/security/advisories/GHSA-pp29-w28g-r9h9 · Note
• https://github.com/mcdope/pam_usb/commit/993e73d8bebb1d8e62677388de3402b6ec36b600 · Note
• https://github.com/mcdope/pam_usb/commit/52a1fd6413b7ffcc1a5b58ce432be42e7bf0dbd0 · Note
• https://github.com/mcdope/pam_usb/commit/1ee8745920388df48d001a8e61ba629071557937 · Note
• https://t.me/CVEtracker/55168 · Telegram Post