CVE-2026-47274: pam_usb Authentication Bypass Vulnerability

CVE-2026-47274 Overview

CVE-2026-47274 is an untrusted search path vulnerability [CWE-427] in pam_usb, a Pluggable Authentication Module (PAM) that provides hardware authentication for Linux systems using removable media. Versions prior to 0.9.0 contain helper tools that resolve external binaries through the PATH environment variable rather than absolute paths. An attacker who can influence the process environment during PAM authentication can substitute malicious binaries for the trusted utilities the helpers invoke. The affected tools are pamusb-check (src/tmux.c), pamusb-conf (tools/pamusb-conf), and pamusb-keyring-unlock-gnome (tools/pamusb-keyring-unlock-gnome). The vulnerability is fixed in version 0.9.0.

Critical Impact
A local attacker with the ability to manipulate the process environment can hijack execution of pam_usb helper binaries, leading to code execution in the context of the authenticating user or service.

Affected Products

pam_usb versions prior to 0.9.0
pamusb-check helper binary (src/tmux.c)
pamusb-conf and pamusb-keyring-unlock-gnome tooling

Discovery Timeline

2026-05-27 - CVE-2026-47274 published to NVD
2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-47274

Vulnerability Analysis

The pam_usb helper tools invoke external utilities such as tmux, findmnt, id, logger, stat, awk, sed, head, pidof, kill, and gnome-keyring-daemon by command name only. Resolution of these names depends on the PATH environment variable at execution time. When a controllable PATH precedes the system binary directories, the loader resolves the command name to an attacker-supplied executable.

Because pam_usb operates inside the PAM authentication stack, the helpers can execute in privileged or sensitive contexts. Successful substitution allows an attacker to run arbitrary code with the permissions of the calling process, which may include privileged service accounts depending on PAM configuration. The flaw is an instance of [CWE-427: Uncontrolled Search Path Element].

Root Cause

The root cause is the use of bare command names in shell invocations and snprintf-built command strings inside the helper tools. In src/tmux.c, the command string built for tmux did not specify an absolute path. In tools/pamusb-conf and tools/pamusb-keyring-unlock-gnome, supporting utilities were similarly resolved through PATH. Any caller able to set or inherit a crafted environment can redirect execution to a substituted binary.

Attack Vector

Exploitation requires local access and the ability to influence the environment passed to pam_usb tooling. The CVSS vector indicates high attack complexity and low privileges required, with no user interaction needed. An attacker prepends a writable directory containing a malicious binary named after the targeted utility to PATH, then triggers PAM authentication or directly invokes the affected helpers.

// Patch in src/tmux.c - hardens tmux command lookup by using an absolute path
// Source: https://github.com/mcdope/pam_usb/commit/993e73d8bebb1d8e62677388de3402b6ec36b600

-    size_t get_tmux_session_details_cmd_len = strlen(tmux_socket_path) + strlen(tmux_client_id) + 64;
+    size_t get_tmux_session_details_cmd_len =
+        strlen("LC_ALL=C; /usr/bin/tmux -S \"\" list-clients -t \"\\$\"")
+        + strlen(tmux_socket_path)
+        + strlen(tmux_client_id)
+        + 1;
     char *get_tmux_session_details_cmd = xmalloc(get_tmux_session_details_cmd_len);
-    snprintf(get_tmux_session_details_cmd, get_tmux_session_details_cmd_len, "LC_ALL=C; tmux -S \"%s\" list-clients -t \"\\$%s\"", tmux_socket_path, tmux_client_id);
+    snprintf(get_tmux_session_details_cmd, get_tmux_session_details_cmd_len, "LC_ALL=C; /usr/bin/tmux -S \"%s\" list-clients -t \"\\$%s\"", tmux_socket_path, tmux_client_id);

The fix in tools/pamusb-keyring-unlock-gnome replaces bare command references with absolute paths assigned to shell variables (PAMUSB_CHECK=/usr/bin/pamusb-check, ID=/usr/bin/id, LOGGER=/usr/bin/logger, etc.). The tools/pamusb-conf patch introduces FINDMNT_PATH = '/usr/bin/findmnt' and uses it explicitly. See the GitHub Security Advisory GHSA-pp29-w28g-r9h9 for full details.

Detection Methods for CVE-2026-47274

Indicators of Compromise

Presence of executable files named tmux, findmnt, id, logger, awk, sed, head, pidof, kill, or gnome-keyring-daemon in user-writable directories that appear earlier in PATH than system directories.
Unexpected child processes spawned from pamusb-check, pamusb-conf, or pamusb-keyring-unlock-gnome.
PAM authentication events correlated with execution of binaries outside /usr/bin or /bin.

Detection Strategies

Audit installed pam_usb versions across Linux fleets and flag any release earlier than 0.9.0.
Use Linux auditd rules to capture execve calls originating from pam_usb helper processes, recording the resolved binary path.
Review PAM session logs for failed or anomalous authentications coinciding with environment variable changes.

Monitoring Recommendations

Monitor PATH modifications in shells and service unit files used by accounts that authenticate via pam_usb.
Alert on writes to directories that may appear in user PATH entries, especially $HOME/bin and /tmp.
Track process ancestry for pam_usb tools to ensure they invoke only binaries from /usr/bin and /bin.

How to Mitigate CVE-2026-47274

Immediate Actions Required

Upgrade pam_usb to version 0.9.0 or later on all affected Linux systems.
Remove or restrict access to the affected helper tools until the upgrade is complete.
Audit user accounts and services that interact with pam_usb authentication for malicious binaries placed in writable PATH entries.

Patch Information

The maintainers released pam_usb 0.9.0 containing three remediating commits. Commit 993e73d hardens the tmux command lookup in src/tmux.c. Commit 52a1fd6 hardens reset-pads path handling in tools/pamusb-conf. Commit 1ee8745 hardens the keyring auth check path in tools/pamusb-keyring-unlock-gnome.

Workarounds

Sanitize the environment of PAM-invoked processes by setting an absolute, trusted PATH in PAM configuration or systemd unit files.
Restrict write access to directories that may appear in the PATH of users authenticating with pam_usb.
Disable the affected helper tools where pam_usb hardware authentication is not in active use.

bash

# Configuration example - enforce a trusted PATH for PAM sessions
# Add to /etc/pam.d/common-session or relevant service file:
session  required  pam_env.so envfile=/etc/security/pam_env.conf

# In /etc/security/pam_env.conf:
PATH    DEFAULT=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin