CVE-2026-47274: CWE-427: Uncontrolled Search Path Element in mcdope pam_usb
pam_usb provides hardware authentication for Linux using ordinary removable media. Prior to 0.9.0, multiple pam_usb helper tools resolved external binaries through the PATH environment variable rather than using absolute paths. An attacker who can influence the process environment during PAM authentication or tool execution could substitute malicious binaries. The affected tools are pamusb-check (src/tmux.c), pamusb-conf (tools/pamusb-conf), and pamusb-keyring-unlock-gnome (tools/pamusb-keyring-unlock-gnome). This vulnerability is fixed in 0.9.0.
AI Analysis
Technical Summary
The vulnerability CVE-2026-47274 in mcdope's pam_usb prior to version 0.9.0 is an uncontrolled search path element issue (CWE-427). Several pam_usb helper tools (pamusb-check, pamusb-conf, pamusb-keyring-unlock-gnome) resolve external binaries using the PATH environment variable instead of absolute paths. This behavior allows an attacker with the ability to influence the process environment during PAM authentication or tool execution to execute arbitrary malicious binaries by substituting them in the search path. The vulnerability is addressed by fixing the tools to use absolute paths in version 0.9.0.
Potential Impact
Successful exploitation could lead to the execution of malicious binaries with the privileges of the affected PAM authentication process. According to the CVSS vector, the attack requires local access with high attack complexity and low privileges, but no user interaction. The impact includes high confidentiality and integrity impact, but no availability impact. There are no known exploits in the wild at this time.
Mitigation Recommendations
This vulnerability is fixed in pam_usb version 0.9.0. Users should upgrade to version 0.9.0 or later to remediate this issue. Since no official patch link or vendor advisory is provided, verify the upgrade availability from the official mcdope pam_usb project sources. Until upgraded, restrict local access to trusted users to reduce risk.
CVE-2026-47274: CWE-427: Uncontrolled Search Path Element in mcdope pam_usb
Description
pam_usb provides hardware authentication for Linux using ordinary removable media. Prior to 0.9.0, multiple pam_usb helper tools resolved external binaries through the PATH environment variable rather than using absolute paths. An attacker who can influence the process environment during PAM authentication or tool execution could substitute malicious binaries. The affected tools are pamusb-check (src/tmux.c), pamusb-conf (tools/pamusb-conf), and pamusb-keyring-unlock-gnome (tools/pamusb-keyring-unlock-gnome). This vulnerability is fixed in 0.9.0.
CVSS v3.1
Score 6.3medium
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability CVE-2026-47274 in mcdope's pam_usb prior to version 0.9.0 is an uncontrolled search path element issue (CWE-427). Several pam_usb helper tools (pamusb-check, pamusb-conf, pamusb-keyring-unlock-gnome) resolve external binaries using the PATH environment variable instead of absolute paths. This behavior allows an attacker with the ability to influence the process environment during PAM authentication or tool execution to execute arbitrary malicious binaries by substituting them in the search path. The vulnerability is addressed by fixing the tools to use absolute paths in version 0.9.0.
Potential Impact
Successful exploitation could lead to the execution of malicious binaries with the privileges of the affected PAM authentication process. According to the CVSS vector, the attack requires local access with high attack complexity and low privileges, but no user interaction. The impact includes high confidentiality and integrity impact, but no availability impact. There are no known exploits in the wild at this time.
Mitigation Recommendations
This vulnerability is fixed in pam_usb version 0.9.0. Users should upgrade to version 0.9.0 or later to remediate this issue. Since no official patch link or vendor advisory is provided, verify the upgrade availability from the official mcdope pam_usb project sources. Until upgraded, restrict local access to trusted users to reduce risk.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-05-18T23:03:37.230Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a17519de29bf47b50e771ad
Added to database: 05/27/2026, 20:18:37 UTC
Last enriched: 06/03/2026, 20:37:29 UTC
Last updated: 07/31/2026, 19:22:59 UTC
Views: 53
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.