CVE-2026-47269

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-47269

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-47269.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-47269

Aliases

GHSA-jmmj-qhrq-w45g

Published

2026-05-27T20:11:44.975Z

Modified

2026-07-08T08:09:41.125108997Z

Severity

7.4 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N CVSS Calculator

Summary

pam_usb: deny_remote feature incorrectly classifies IPv4-mapped IPv6 remote connections as local

Details

pamusb provides hardware authentication for Linux using ordinary removable media. Prior to 0.9.0, pamusb's denyremote feature checks utmpx utaddrv6 to detect whether an authentication request originates from a remote session. The outer guard was if (utent->utaddrv6[0] != 0), which only tests the first 32-bit word of the 128-bit address field. IPv4-mapped IPv6 addresses (::ffff:x.x.x.x) store the IPv4 address in utaddrv6[3] with utaddrv6[0] == 0. On systems where the SSH daemon listens on :: (IPv6 wildcard) with AddressFamily any -- common on Ubuntu and Debian -- incoming IPv4 connections are recorded in utmpx as IPv4-mapped IPv6 addresses. The outer check evaluates to false, the remote-detection block is skipped entirely, and the session is treated as local. denyremote=true does not block the authentication. An attacker with physical access to a registered USB device can authenticate over SSH on an affected system as if they were sitting at a local terminal, bypassing the deny_remote restriction. This vulnerability is fixed in 0.9.0.

Database specific

{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-284"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/47xxx/CVE-2026-47269.json"
}

References

Affected packages

Git / github.com/mcdope/pam_usb

Affected ranges

Type

GIT

Repo

https://github.com/mcdope/pam_usb

Events

Introduced

Fixed

804fe24eae3d742d8be05fd015e36abc3c7d94e5

Database specific

{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "0.9.0"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-47269.json"