CVE-2026-47274: pam_usb: Uncontrolled search path in pam_usb tools allows privilege escalation via PATH manipulation
pamusb provides hardware authentication for Linux using ordinary removable media. Prior to 0.9.0, multiple pamusb helper tools resolved external binaries through the PATH environment variable rather than using absolute paths. An attacker who can influence the process environment during PAM authentication or tool execution could substitute malicious binaries. The affected tools are pamusb-check (src/tmux.c), pamusb-conf (tools/pamusb-conf), and pamusb-keyring-unlock-gnome (tools/pamusb-keyring-unlock-gnome). This vulnerability is fixed in 0.9.0.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-47274?
The severity of CVE-2026-47274 is medium with a score of 6.3.
What vulnerability does CVE-2026-47274 represent?
CVE-2026-47274 represents an uncontrolled search path vulnerability in pam_usb tools that allows privilege escalation through PATH manipulation.
How do I fix CVE-2026-47274?
To fix CVE-2026-47274, update pam_usb to version 0.9.0 or later, which uses absolute paths for external binaries.
What impact does CVE-2026-47274 have on my system?
CVE-2026-47274 can potentially allow attackers to escalate privileges on the system by manipulating the PATH environment variable.
Who is affected by CVE-2026-47274?
Users of pam_usb prior to version 0.9.0 are affected by CVE-2026-47274.