CVE-2026-44712: pam_usb: Shell injection via device UUID and username in pamusb-conf and pamusb-agent

Synopsis

Shell injection vulnerabilities in pam_usb (versions before 0.8.7) allow an attacker with admin-level access to inject arbitrary shell commands through crafted device UUIDs in the configuration file or through a malicious username value passed to os.system() in pamusb-agent. The attack is local, requires high privileges to set up the malicious config, and runs with root-level scope due to how the affected tools invoke shell commands. Successful exploitation gives the attacker full read, write, and execution control over the host. HarborGuard tracks this advisory and will make a patched-image rebuild available as soon as an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network access is required to trigger the injection.

• AuthenticationRequired

  An admin or privileged account is needed to write the malicious UUID or username into the pam_usb configuration file.

• Victim interactionNot required

  No victim interaction is required; the payload executes when the affected tool processes the crafted configuration.

• Attack complexityDetail

  The exploit is reliable and condition-free once the crafted config value is in place, requiring no race conditions or special memory layout.

Blast Radius

• The attacker executes arbitrary commands as root, gaining full control over the host system.
• All files and stored secrets on the host, including credentials and key material, become readable.
• The attacker can modify or delete any file on the system, including system binaries and persistent configuration.
• Host services can be crashed, reconfigured, or repurposed at the attacker's discretion.