CVE-2026-44709: pam_usb: PINENTRY_FALLBACK_APP environment variable allows arbitrary command execution

Synopsis

An environment-variable injection vulnerability in pam_usb (the pamusb-pinentry component) allows a local attacker with a low-privilege account to execute arbitrary commands with the privileges of the pam_usb tool chain. The flaw is reachable locally: an attacker sets the PINENTRY_FALLBACK_APP environment variable to any binary or script before pamusb-pinentry is invoked, and that target is executed without validation. Successful exploitation gives the attacker full read, write, and execution control at the elevated privilege level of the pam_usb stack. No fix version has been published upstream yet; HarborGuard is tracking the advisory and will make a patched-image rebuild available as soon as an upstream fix ships.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network access to the target service is required.

• AuthenticationRequired

  Any low-privilege local account is sufficient to set environment variables before pamusb-pinentry is invoked.

• Victim interactionNot required

  No user interaction is needed; the attacker sets the environment variable and waits for or triggers a pam_usb authentication flow.

• Attack complexityDetail

  The exploit is reliable and condition-free: no race conditions, memory layout dependencies, or special environmental factors are required.

Blast Radius

• Reads sensitive files and credentials accessible to the pam_usb privilege level, including authentication material on the host.
• Writes or modifies files owned by the elevated process, enabling persistent backdoors or configuration tampering.
• Executes arbitrary binaries with the elevated privileges of the pam_usb tool chain, allowing full local privilege escalation.
• Disrupts the authentication subsystem itself by replacing or corrupting pam_usb components.