Read the docs
TI-2026-32600 Aliases CVE-2026-44713

pam_usb: Command injection via $TMUX environment variable leads to RCE as root

Priority LOW 39CWE-116Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-78.

Summary

pam_usb provides hardware authentication for Linux using ordinary removable media. Prior to 0.8.7, src/tmux.c reads the user's $TMUX environment variable, splits it on commas, and interpolates the socket-path component directly into a shell command passed to popen(). Because the value is placed inside double-quotes without sanitisation, any value containing " terminates the quoted string and injects arbitrary shell syntax. popen() runs as root inside the PAM stack. This vulnerability is fixed in 0.8.7.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00158 4th percentileScored 2026-11-07
Fix Fixed pam_usb (mcdope): 0.8.7

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
mcdopepam_usbbefore 0.8.70.8.7Patch availableCNA
  • pam_usb Vendormcdope Affected before 0.8.7 Fixed in 0.8.7 Patch available CNA

Remediation

  • Fix · CNA pam_usb (mcdope) Fixed in 0.8.7

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-44713

References

Other 1

  • TI-2026-35505 pam_usb: PAM_RHOST check skipped when deny_remote=false allows XDMCP authentication bypass CVSS 3.1HIGH 8.1
  • TI-2026-32598 pam_usb: Symlink attacks on pad directory and pad files enable authentication bypass and root file corruption CVSS 3.1HIGH 7.9
  • TI-2026-32596 pam_usb: PINENTRY_FALLBACK_APP environment variable allows arbitrary command execution CVSS 3.1HIGH 7.8
  • TI-2026-32599 pam_usb: Shell injection via device UUID and username in pamusb-conf and pamusb-agent CVSS 3.1HIGH 8.2
  • TI-2026-34849 pam_usb: deny_remote feature incorrectly classifies IPv4-mapped IPv6 remote connections as local CVSS 3.1HIGH 7.4
  • TI-2026-34852 pam_usb: OTP pad authentication bypass via missing system pad check and uninitialized RNG buffer CVSS 3.1HIGH 7.1
See all 21 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences