PT-2026-44109 · Pam Usb · Pam Usb

Mcdope · CVE-2026-44709 · Published 2026-05-27 · Updated 2026-05-28

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions pam usb versions prior to 0.8.7

Description pam usb provides hardware authentication for Linux using removable media. The pamusb-pinentry component reads the PINENTRY FALLBACK APP environment variable and executes it without validation. A process capable of setting environment variables before pamusb-pinentry is invoked can point PINENTRY FALLBACK APP to an arbitrary binary or script, leading to execution with the privileges of the pam usb tool chain.

Recommendations Update to version 0.8.7.

Exploit

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2026-44709

GHSA-JXRJ-Q67X-WR4C

Affected Products

Pam Usb

References · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44709.json · Exploit
• 🔥 https://github.com/mcdope/pam_usb/security/advisories/GHSA-jxrj-q67x-wr4c · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-44709 · Security Note
• https://osv.dev/vulnerability/CVE-2026-44709 · Vendor Advisory
• https://t.me/CVEtracker/55174 · Telegram Post
• https://t.me/cveNotify/164947 · Telegram Post