CVE-2026-47274

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-47274
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-47274.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-47274
Aliases
  • GHSA-pp29-w28g-r9h9
Published
2026-05-27T20:02:38Z
Modified
2026-10-28T10:51:47Z
Severity
  • 6.3 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N CVSS Calculator
Summary
pam_usb: Uncontrolled search path in pam_usb tools allows privilege escalation via PATH manipulation
Details

pam_usb provides hardware authentication for Linux using ordinary removable media. Prior to 0.9.0, multiple pam_usb helper tools resolved external binaries through the PATH environment variable rather than using absolute paths. An attacker who can influence the process environment during PAM authentication or tool execution could substitute malicious binaries. The affected tools are pamusb-check (src/tmux.c), pamusb-conf (tools/pamusb-conf), and pamusb-keyring-unlock-gnome (tools/pamusb-keyring-unlock-gnome). This vulnerability is fixed in 0.9.0.

Database specific 
{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-427"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/47xxx/CVE-2026-47274.json"
}
References

Affected packages

Git / github.com/mcdope/pam_usb

Affected ranges

Type
GIT
Repo
https://github.com/mcdope/pam_usb
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
c1eba240c30dc377619492affca6f0c130e4fa9e
Fixed
1ee8745920388df48d001a8e61ba629071557937
Fixed
52a1fd6413b7ffcc1a5b58ce432be42e7bf0dbd0
Fixed
993e73d8bebb1d8e62677388de3402b6ec36b600
Database specific
Show details 
{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "fixed":  "0.9.0"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StringRangeExpression"
        },
        {
            "range":  [
                {
                    "fixed":  "1ee8745920388df48d001a8e61ba629071557937"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        },
        {
            "range":  [
                {
                    "fixed":  "52a1fd6413b7ffcc1a5b58ce432be42e7bf0dbd0"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        },
        {
            "range":  [
                {
                    "fixed":  "993e73d8bebb1d8e62677388de3402b6ec36b600"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

0.*
0.5.0
0.7.1
0.7.2
0.7.3
0.8.3
0.8.4
0.8.7
v0.*
v0.7.0
v0.8.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-47274.json"
vanir_signatures 
[
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "206666566369348414222264955120073332973"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-47274-10178184",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/mcdope/pam_usb/commit/c1eba240c30dc377619492affca6f0c130e4fa9e",
        "target":  {
            "file":  "src/version.h"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "305510509289867684386701751581690652900",
            "length":  1977
        },
        "id":  "CVE-2026-47274-294505bb",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/mcdope/pam_usb/commit/993e73d8bebb1d8e62677388de3402b6ec36b600",
        "target":  {
            "file":  "src/tmux.c",
            "function":  "pusb_tmux_get_client_tty"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "67358986752993045379164481997120556207",
                "215280849683253486817086468589100363945",
                "107485095675293365107062698318919698648",
                "334618793470390354861895548587381098367",
                "221074012090605430723492807025260889213",
                "132600697859106215483206167642152094410",
                "267868390585593816517915983992887850017"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-47274-3e9dbb50",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/mcdope/pam_usb/commit/993e73d8bebb1d8e62677388de3402b6ec36b600",
        "target":  {
            "file":  "src/tmux.c"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "209703897491804402336027870541283587853",
                "326717004773221440284047202471710731375",
                "193841822453062366111197863556775284661",
                "325577364329642837533283123858452836399",
                "67046406618631748663039062885867112750",
                "161098121079489355962348216145199472689",
                "147627297587331535497751378082131152168",
                "68517649343567507197171355113496533147",
                "232063608063545694251461812487647294996",
                "135399071238016763047535409142022088406",
                "96249688255229574990695498906277129507",
                "306777512902495044249742328321347210321",
                "288548935940845890567995283410426001214",
                "158089490688310365503670448746200002857",
                "333155553264432249524124478937672416634"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-47274-dfdd71c3",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/mcdope/pam_usb/commit/993e73d8bebb1d8e62677388de3402b6ec36b600",
        "target":  {
            "file":  "tests/unit/c/tmux_test.c"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "147097916991957875131052787336673712036",
            "length":  171
        },
        "id":  "CVE-2026-47274-f5950eb9",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/mcdope/pam_usb/commit/993e73d8bebb1d8e62677388de3402b6ec36b600",
        "target":  {
            "file":  "tests/unit/c/tmux_test.c",
            "function":  "__wrap_popen"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "149085765227324310562013975114386882296",
            "length":  1113
        },
        "id":  "CVE-2026-47274-f67f2905",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/mcdope/pam_usb/commit/993e73d8bebb1d8e62677388de3402b6ec36b600",
        "target":  {
            "file":  "tests/unit/c/tmux_test.c",
            "function":  "main"
        }
    }
]
vanir_signatures_modified 
"2026-10-28T10:51:47Z"