# CVE-2026-47274: mcdope pam_usb uncontrolled search path in helper tools

Source: https://junglewise.ai/threats/cve-2026-47274-mcdope-pam-usb-uncontrolled-search-path-in-helper-tools  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-27. Updated: 2026-05-27  
License: CC BY 4.0 with a link back

CVE-2026-47274 · Severity: medium · CVSS 6.3 · Published 2026-05-27

pam_usb is a tool that allows users to log into Linux systems using a USB drive instead of a password. A security flaw in several of its helper tools allows an attacker with local access to trick the system into running malicious programs instead of legitimate system utilities. This could lead to an attacker gaining unauthorized access to sensitive data or elevated system privileges.

Technologies: [Mcdope Pam Usb](https://junglewise.ai/threats/technologies/pam-usb). Vendors: [Mcdope](https://junglewise.ai/threats/vendors/mcdope).

## Quick answers

**Is CVE-2026-47274 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-47274 being exploited in the wild.

**How severe is CVE-2026-47274?** Medium severity, with a CVSS score of 6.3, published 27 May 2026.

**Which products and versions are affected?** Mcdope Pam Usb < 0.9.0.

**Is there a fix for CVE-2026-47274?** A patch was published on 2026-05-17: Fixes committed to repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-47274 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-47274?** Check whether you run Mcdope Pam Usb at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

Multiple helper tools in pam_usb, including pamusb-check, pamusb-conf, and pamusb-keyring-unlock-gnome, resolve external binaries (such as tmux, findmnt, and id) using the PATH environment variable rather than absolute paths. An attacker who can influence the process environment during PAM authentication or tool execution can substitute malicious binaries to achieve local privilege escalation. Additionally, pamusb-keyring-unlock-gnome was found to source password files using shell eval and pass passwords via command-line arguments, further increasing the risk of credential exposure. These issues are addressed in version 0.9.0 by using absolute paths and reading password files as data.

## Affected products

- mcdope pam_usb < 0.9.0

## Timeline

- 2026-05-17: patched: Fixes committed to repository
- 2026-05-20: advisory: GitHub Security Advisory published
- 2026-05-27: disclosed: CVE published to NVD

## References

- [https://github.com/mcdope/pam_usb/commit/1ee8745920388df48d001a8e61ba629071557937](https://github.com/mcdope/pam_usb/commit/1ee8745920388df48d001a8e61ba629071557937)
- [https://github.com/mcdope/pam_usb/commit/52a1fd6413b7ffcc1a5b58ce432be42e7bf0dbd0](https://github.com/mcdope/pam_usb/commit/52a1fd6413b7ffcc1a5b58ce432be42e7bf0dbd0)
- [https://github.com/mcdope/pam_usb/commit/993e73d8bebb1d8e62677388de3402b6ec36b600](https://github.com/mcdope/pam_usb/commit/993e73d8bebb1d8e62677388de3402b6ec36b600)
- [https://github.com/mcdope/pam_usb/security/advisories/GHSA-pp29-w28g-r9h9](https://github.com/mcdope/pam_usb/security/advisories/GHSA-pp29-w28g-r9h9)

## Related threats

- [pam_usb heap out-of-bounds read in display server handling](https://junglewise.ai/threats/cve-2026-64667-pam-usb-provides-hardware-authentication-for-linux-using)
- [pam_usb XRDP session bypass via environment variable](https://junglewise.ai/threats/cve-2026-64666-pam-usb-provides-hardware-authentication-for-linux-using)
- [mcdope pam_usb symlink race condition in pad directory creation](https://junglewise.ai/threats/cve-2026-48983-mcdope-pam-usb-symlink-race-condition-in-pad-directory-creation)
- [mcdope pam_usb race condition in one-time pad update](https://junglewise.ai/threats/cve-2026-48982-mcdope-pam-usb-race-condition-in-one-time-pad-update)
- [mcdope pam_usb XXE in configuration file parsing](https://junglewise.ai/threats/cve-2026-48981-mcdope-pam-usb-xxe-in-configuration-file-parsing)