Vulnerabilities/CVE-2026-44713

CVE-2026-44713: pam_usb: Command injection via $TMUX environment variable leads to RCE as root

SSVC decisionTrack*Monitor closely. May escalate on new signals.

ExploitationNone

AutomatableNo

Technical impactTotal

Mission & well-beingHigh (assumed)

Source: CISA-ADP, SSVC v2.0.3As of 30-05-2026 01:47 UTCCISA publishes the first three inputs. Mission & well-being depends on your environment, so it is assumed at its highest: the decision is a worst case.

Deferred

Published 27-05-2026Last modified 30-05-2026

On this page

Summary Timeline Description CVSS metrics EPSS trend Known exploited Public exploits Weaknesses Affected systems References

Key information

Published27-05-2026

Modified30-05-2026

SourceCVE.org

CVSS8.8

EPSS0.21%

KEV0

Exploits0

Vulnerability summary

CVE-2026-44713 is a high (CVSS 8.8) OS Command Injection vulnerability in mcdope pam_usb. EPSS estimates a 0.21% chance of exploitation in the next 30 days, higher than 10.7% of scored vulnerabilities.

Overall risk

35/100

0100

Medium · default modelHow is this calculated?

SSVC decisionTrack*Monitor closely. May escalate on new signals.

ExploitationNone

AutomatableNo

Technical impactTotal

Mission & well-beingHigh (assumed)

CVSS score

8.8/10

010

High · v3.1 (CVE.org)

EPSS score

0.21%

0%100%

Low · +0.05 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Timeline

27-05-2026
PublishedVulnerability first disclosed.
30-05-2026
Last modifiedVulnerability information updated.

Description

pam_usb provides hardware authentication for Linux using ordinary removable media. Prior to 0.8.7, src/tmux.c reads the user's $TMUX environment variable, splits it on commas, and interpolates the socket-path component directly into a shell command passed to popen(). Because the value is placed inside double-quotes without sanitisation, any value containing " terminates the quoted string and injects arbitrary shell syntax. popen() runs as root inside the PAM stack. This vulnerability is fixed in 0.8.7.

CVSS metrics

2 scores · 2 sources · 1 version

v3.18.8

High 8.8Preferred score · CVE.org (CNA)

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

SourcesAll 2 agree

NVDNIST8.8HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

EPSS trend

Probability

0.21%

Chance of exploitation in the next 30 days

Percentile

11%

Versus all other CVEs

30-day change

Increase +0.05 pp

From 0.16% on 22-09-2026

100%75%50%25%0%

22-09-202622-10-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-78Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
CWE-116Improper Encoding or Escaping of OutputThe product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.

Affected systems

Mcdope1 product

pam_usb< 0.8.7

1 vendor · 1 product

References

1 links

github.com/mcdope/pam_usb/security/advisories/GHSA-822m-whrh-vrj8X Refsource CONFIRM

Related vulnerabilities

MediumCVE-2026-47274mcdope · pam_usb4mo agopam_usb: Uncontrolled search path in pam_usb tools allows privilege escalation via PATH manipulationpam_usb provides hardware authentication for Linux using ordinary removable media. Prior to 0.9.0, multiple pam_usb helper tools resolved external binaries through the PATH environment variable rather than using absolute paths. An attacker who can influence the process environment during PAM authentication or tool execution could substitute malicious binaries. The affected tools are pamusb-check (src/tmux.c), pamusb-conf (tools/pamusb-conf), and pamusb-keyring-unlock-gnome (tools/pamusb-keyring-unlock-gnome). This vulnerability is fixed in 0.9.0.EPSS0.18%HighCVE-2026-47272mcdope · pam_usb4mo agopam_usb: OTP pad authentication bypass via missing system pad check and uninitialized RNG bufferpam_usb provides hardware authentication for Linux using ordinary removable media. Prior to 0.9.0, the pusb_pad_compare() function in src/pad.c only verified that the user-side pad (~/.pamusb/device.pad) could be read, but did not enforce that the system-side pad (the pad file on the USB device) was also present and readable. If the user-side pad was deleted or unreadable, the function returned a failure that was treated as non-fatal in certain code paths, allowing authentication to succeed without the USB device being verified. A local user can delete their own ~/.pamusb/device.pad to remove the USB device requirement and authenticate without the physical device. This vulnerability is fixed in 0.9.0.EPSS0.17%MediumCVE-2026-47273mcdope · pam_usb4mo agopam_usb: XPath injection via PAM-supplied identifiers in pam_usb configuration queriespam_usb provides hardware authentication for Linux using ordinary removable media. Prior to 0.9.0, pam_usb builds XPath expressions from user-supplied identifiers (PAM username, service name) and device-supplied identifiers (USB device serial, model, vendor) to query /etc/pamusb.conf. These identifiers were not validated for XPath metacharacters, allowing injection of arbitrary XPath predicates. This vulnerability is fixed in 0.9.0.EPSS0.41%MediumCVE-2026-47271mcdope · pam_usb4mo agopam_usb: OOM guards removed by -DNDEBUG cause NULL dereference and authentication process crashpam_usb provides hardware authentication for Linux using ordinary removable media. Prior to 0.9.0, src/mem.c implemented out-of-memory guards for xmalloc(), xrealloc(), and xstrdup() using assert(data != NULL). The C standard specifies that all assert() expressions are compiled out when NDEBUG is defined at build time. NDEBUG is commonly defined in release and packaging builds (Debian, Fedora, Arch package flags all define it via -DNDEBUG in CFLAGS). With the guard removed, xmalloc/xrealloc/xstrdup silently return NULL on allocation failure. Every caller in the codebase dereferences the return value without a NULL check -- this is the intended design, as the guard was supposed to abort before the dereference. With the guard gone, any allocation failure causes a NULL pointer dereference, crashing the PAM module. A crash in a PAM module loaded by sudo or login causes authentication to fail for the duration of the crash, creating a local denial-of-service condition. An attacker who can induce memory pressure at authentication time can lock all users out of sudo and login. This vulnerability is fixed in 0.9.0.EPSS0.16%HighCVE-2026-47269mcdope · pam_usb4mo agopam_usb: deny_remote feature incorrectly classifies IPv4-mapped IPv6 remote connections as localpam_usb provides hardware authentication for Linux using ordinary removable media. Prior to 0.9.0, pam_usb's deny_remote feature checks utmpx ut_addr_v6 to detect whether an authentication request originates from a remote session. The outer guard was if (utent->ut_addr_v6[0] != 0), which only tests the first 32-bit word of the 128-bit address field. IPv4-mapped IPv6 addresses (::ffff:x.x.x.x) store the IPv4 address in ut_addr_v6[3] with ut_addr_v6[0] == 0. On systems where the SSH daemon listens on :: (IPv6 wildcard) with AddressFamily any -- common on Ubuntu and Debian -- incoming IPv4 connections are recorded in utmpx as IPv4-mapped IPv6 addresses. The outer check evaluates to false, the remote-detection block is skipped entirely, and the session is treated as local. deny_remote=true does not block the authentication. An attacker with physical access to a registered USB device can authenticate over SSH on an affected system as if they were sitting at a local terminal, bypassing the deny_remote restriction. This vulnerability is fixed in 0.9.0.EPSS0.45%MediumCVE-2026-47270mcdope · pam_usb4mo agopam_usb: strtok() race condition in multi-threaded PAM hosts can corrupt deny_remote resultpam_usb provides hardware authentication for Linux using ordinary removable media. Prior to 0.9.0, pam_usb is a PAM module loaded into the host process (sudo, login, GDM, GNOME Shell). Display managers such as GDM run multiple concurrent authentication threads. Three functions used by the deny_remote feature called the non-reentrant strtok(), which stores state in a single global pointer. If two authentications race, one thread's strtok() call can overwrite the other's in-progress tokenisation pointer, causing incorrect parsing of the tmux session data or the /proc environ scan that backs the remote-session detection logic. Additionally, pusb_tmux_get_client_tty() passed the raw pointer returned by getenv(TMUX) directly to strtok(). getenv() returns a pointer into the live process environment block; strtok() inserts NUL bytes into that block, permanently corrupting the TMUX variable for subsequent code running in the same process. In long-lived display managers this affects all future authentications in that process. The combined effect can cause deny_remote=true to return an incorrect decision for a remote session, or an incorrect decision for a local session, depending on thread interleaving. This vulnerability is fixed in 0.9.0.EPSS0.13%

All vulnerabilities inpam_usb