CVE-2026-44712

pam_usb provides hardware authentication for Linux using ordinary removable media. Prior to 0.8.7, a crafted UUID such as $(id>/tmp/rce) in the config causes root RCE when pamusb-conf --reset-pads is run. A USB device with a crafted filesystem UUID (some controllers allow this) can inject the payload at --add-device time. Also, userName from the XML config is passed to os.system() in pamusb-agent, which invokes a shell. This vulnerability is fixed in 0.8.7.

• CWE-78
• CWE-88

• https://github.com/mcdope/pam_usb/security/advisories/GHSA-jgv5-w6rm-7wxg

Published

May 27, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-44707Chatwoot is a customer engagement suite. From 2.14.0 to befo…6.8
• CVE-2026-44708Mistune is a Python Markdown parser with renderers and plugi…6.1
• CVE-2026-44709pam_usb provides hardware authentication for Linux using ord…7.8
• CVE-2026-4471A weakness has been identified in itsourcecode Online Frozen…9.8
• CVE-2026-44710pam_usb provides hardware authentication for Linux using ord…4.6
• CVE-2026-44711pam_usb provides hardware authentication for Linux using ord…7.9
• CVE-2026-44713pam_usb provides hardware authentication for Linux using ord…8.8
• CVE-2026-44714The bitcoinj library is a Java implementation of the Bitcoin…7.5
• CVE-2026-44716Pipecat is an open-source Python framework for building real…7.5
• CVE-2026-44717MCP Calculate Server is a mathematical calculation service b…9.8
• CVE-2026-44718Mathesar is a web application that makes working with Postgr…5.3
• CVE-2026-44719Mathesar is a web application that makes working with Postgr…5.3