PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-44709 mcdope CVE debrief

pam_usb prior to version 0.8.7 contains a command injection vulnerability in its pinentry fallback mechanism. The `pamusb-pinentry` utility reads the `PINENTRY_FALLBACK_APP` environment variable and executes its contents directly without validation. Any process capable of setting environment variables before `pamusb-pinentry` invocation can inject arbitrary commands, which execute with the privileges of the pam_usb authentication chain. This represents a local privilege escalation path where low-privilege processes can influence authentication components. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) indicates local attack vector with low complexity, requiring low privileges but no user interaction, yielding high impact across confidentiality, integrity, and availability. The vulnerability is classified under CWE-78 (OS Command Injection). Version 0.8.7 contains the remediation.

Vendor
mcdope
Product
pam_usb
CVSS
HIGH 7.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-27
Original CVE updated
2026-05-28
Advisory published
2026-05-27
Advisory updated
2026-05-28

Who should care

Linux system administrators deploying hardware-based authentication via pam_usb, security teams managing PAM configurations, and organizations using removable media for multi-factor authentication on Linux endpoints

Technical summary

The pamusb-pinentry component in pam_usb versions prior to 0.8.7 fails to validate the PINENTRY_FALLBACK_APP environment variable before passing it to execution contexts. This OS command injection weakness (CWE-78) allows attackers with local access and low privileges to execute arbitrary binaries or scripts through environment variable manipulation. The vulnerability exists in the authentication fallback path and executes with elevated privileges associated with the PAM authentication stack. Remediation requires updating to pam_usb 0.8.7 which implements proper input validation for the fallback application path.

Defensive priority

HIGH

Recommended defensive actions

  • Upgrade pam_usb to version 0.8.7 or later to eliminate the command injection vulnerability
  • Audit systems for unauthorized modifications to PINENTRY_FALLBACK_APP environment variable in PAM configuration contexts
  • Review PAM stack configurations to identify deployments using pam_usb with pinentry fallback mechanisms
  • Implement environment variable sanitization controls for processes invoking authentication components
  • Monitor authentication logs for anomalous pam_usb behavior or unexpected child process execution
  • Validate integrity of pam_usb packages through cryptographic signatures before deployment

Evidence notes

Vulnerability description sourced from official CVE record and NVD entry. Technical details confirmed through GitHub Security Advisory GHSA-jxrj-q67x-wr4c. CVSS vector and CWE classification extracted from NVD metadata. Fix version 0.8.7 explicitly stated in advisory.

Official resources

2026-05-27