CVE-2026-44709: pam_usb: PINENTRY_FALLBACK_APP environment variable allows arbitrary command execution
pamusb provides hardware authentication for Linux using ordinary removable media. Prior to 0.8.7, pamusb-pinentry reads the PINENTRYFALLBACKAPP environment variable and executes it directly without any validation. Any process that can set environment variables before pamusb-pinentry is invoked can point PINENTRYFALLBACKAPP at an arbitrary binary or script and have it executed with the privileges of the pamusb tool chain. This vulnerability is fixed in 0.8.7.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-44709?
CVE-2026-44709 has a severity score of 7.8, categorized as high.
How do I fix CVE-2026-44709?
To mitigate CVE-2026-44709, upgrade to pam_usb version 0.8.7 or later where the vulnerability has been addressed.
What types of systems are affected by CVE-2026-44709?
CVE-2026-44709 affects Linux systems using the pam_usb module for hardware authentication.
What is the potential impact of CVE-2026-44709?
CVE-2026-44709 can lead to arbitrary command execution, allowing an attacker to execute commands on the system.
How can an attacker exploit CVE-2026-44709?
An attacker can exploit CVE-2026-44709 by setting the PINENTRY_FALLBACK_APP environment variable to execute malicious commands when pamusb-pinentry is invoked.