Read the docs
TI-2026-32598 Aliases CVE-2026-44711

pam_usb: Symlink attacks on pad directory and pad files enable authentication bypass and root file corruption

Priority HIGH 70CWE-287Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
Required
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
None · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-287.

Summary

pam_usb provides hardware authentication for Linux using ordinary removable media. Prior to 0.8.7, symlink attacks on pad directory and pad files enable authentication bypass and root file corruption. This vulnerability is fixed in 0.8.7.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00235 14th percentileScored 2026-11-07
Fix Fixed pam_usb (mcdope): 0.8.7

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
mcdopepam_usbbefore 0.8.70.8.7Patch availableCNA
  • pam_usb Vendormcdope Affected before 0.8.7 Fixed in 0.8.7 Patch available CNA

Remediation

  • Fix · CNA pam_usb (mcdope) Fixed in 0.8.7

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-44711

References

Other 1

  • TI-2026-35505 pam_usb: PAM_RHOST check skipped when deny_remote=false allows XDMCP authentication bypass CVSS 3.1HIGH 8.1
  • TI-2026-32596 pam_usb: PINENTRY_FALLBACK_APP environment variable allows arbitrary command execution CVSS 3.1HIGH 7.8
  • TI-2026-32600 pam_usb: Command injection via $TMUX environment variable leads to RCE as root CVSS 3.1HIGH 8.8
  • TI-2026-32599 pam_usb: Shell injection via device UUID and username in pamusb-conf and pamusb-agent CVSS 3.1HIGH 8.2
  • TI-2026-34849 pam_usb: deny_remote feature incorrectly classifies IPv4-mapped IPv6 remote connections as local CVSS 3.1HIGH 7.4
  • TI-2026-34852 pam_usb: OTP pad authentication bypass via missing system pad check and uninitialized RNG buffer CVSS 3.1HIGH 7.1
See all 21 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences