Is CVE-2026-47270 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-47270 being exploited in the wild.

How severe is CVE-2026-47270?

Medium severity, with a CVSS score of 6.3, published 27 May 2026.

Is there a fix for CVE-2026-47270?

A patch was published on 2026-05-17: Fixes committed to repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-47270 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2026-47270?

Check whether you run Mcdope Pam Usb at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-47270: pam_usb race condition in remote session detection

CVE-2026-47270 · Severity: medium · CVSS 6.3 · Published 2026-05-27

pam_usb is a tool that allows users to log into Linux systems using a USB drive as a physical key. A flaw in how the software handles multiple login attempts at once can cause it to incorrectly identify whether a user is logging in locally or remotely. This could allow an attacker to bypass security restrictions intended to block remote access, potentially gaining unauthorized entry to the system.

Technologies: Mcdope Pam Usb. Vendors: Mcdope.

Quick answers

Is CVE-2026-47270 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-47270 being exploited in the wild.
How severe is CVE-2026-47270?: Medium severity, with a CVSS score of 6.3, published 27 May 2026.
Which products and versions are affected?: Mcdope Pam Usb < 0.9.0.
Is there a fix for CVE-2026-47270?: A patch was published on 2026-05-17: Fixes committed to repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-47270 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2026-47270?: Check whether you run Mcdope Pam Usb at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The pam_usb module prior to version 0.9.0 utilizes the non-reentrant strtok() function in three critical functions: pusb_tmux_get_client_tty(), pusb_tmux_has_remote_clients(), and pusb_get_process_envvar(). Because strtok() uses a global static pointer, concurrent authentication threads in display managers like GDM can cause race conditions that corrupt the tokenization state. This leads to incorrect parsing of tmux session data or /proc environment scans used for remote-session detection. Furthermore, the module incorrectly passed pointers from getenv() directly to strtok(), causing permanent corruption of the process environment block by inserting NUL bytes. These issues can result in the 'deny_remote' feature failing to block remote sessions or incorrectly blocking local ones. The vulnerability is fixed in version 0.9.0 by migrating to strtok_r() and using private heap copies of environment variables.

Affected products

mcdope pam_usb < 0.9.0

Timeline

2026-05-17: patched: Fixes committed to repository
2026-05-20: advisory: GitHub Security Advisory published
2026-05-27: disclosed: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.