CVE-2026-47274

MediumCVSS 6.3/10Last modified Jun 17, 2026

Description

pam_usb provides hardware authentication for Linux using ordinary removable media. Prior to 0.9.0, multiple pam_usb helper tools resolved external binaries through the PATH environment variable rather than using absolute paths. An attacker who can influence the process environment during PAM authentication or tool execution could substitute malicious binaries. The affected tools are pamusb-check (src/tmux.c), pamusb-conf (tools/pamusb-conf), and pamusb-keyring-unlock-gnome (tools/pamusb-keyring-unlock-gnome). This vulnerability is fixed in 0.9.0.

Metrics

CVSS 3.1 6.3/10CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-427

Affected software

No affected versions have been published.

Timeline

Published: May 27, 2026
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-472752.6In nanomq versions 0.24.11 and earlier, a NULL pointer dereference in `nni_mqttv5_msg_decode_connect()` allows a malicious MQTT broker to cr CVE-2026-472766.5In nanomq versions 0.24.11 and earlier, a NULL pointer dereference in `properties_parse()` allows an authenticated attacker to crash the Nan CVE-2026-472776.5Runtipi is a personal homeserver orchestrator. In versions 4.9.1 through 4.9.3, Runtipi serves marketplace app logos from files inside clone CVE-2026-472796.9NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, the public shared-view relation endpoints accepted a caller-s CVE-2026-47286.5Spoofing issue in the Privacy: Anti-Tracking component. This vulnerability was fixed in Firefox 149 and Thunderbird 149.CVE-2026-472809.8Improper authentication in Azure Resource Manager (ARM) allows an unauthorized attacker to elevate privileges over a network.CVE-2026-472819.6Missing authorization in Visual Studio Code allows an unauthorized attacker to elevate privileges over a network.CVE-2026-472826.5Insufficiently protected credentials in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to disclose information over a CVE-2026-472846.5Exposure of sensitive information to an unauthorized actor in Visual Studio Code allows an unauthorized attacker to disclose information ove CVE-2026-472856.5Improper neutralization of special elements used in a command ('command injection') in Visual Studio Code allows an unauthorized attacker to CVE-2026-472876.5Relative path traversal in Visual Studio Code allows an unauthorized attacker to perform tampering over a network.CVE-2026-472887.1Integer overflow or wraparound in Windows Kerberos allows an authorized attacker to execute code over an adjacent network.