CVE-2026-44713: pam_usb: Command injection via $TMUX environment variable leads to RCE as root

Synopsis

Command injection in pam_usb (versions before 0.8.7) allows a local attacker with a low-privilege account to execute arbitrary commands as root. The flaw is in src/tmux.c, which reads the user-controlled $TMUX environment variable, splits it on commas, and interpolates the socket-path segment directly into a shell command passed to popen() without sanitizing double-quote characters. An attacker who can set their own environment variables can break out of the quoted string and inject arbitrary shell syntax, gaining full root-level code execution on the host. No fix version has been published upstream yet; HarborGuard is tracking the advisory for patch availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network access is required to trigger the vulnerability.

• AuthenticationRequired

  Any low-privilege local account is sufficient; the attacker only needs enough access to set their own environment variables before triggering a PAM authentication event.

• Victim interactionNot required

  No interaction from another user or administrator is needed; the attacker triggers the vulnerable code path entirely through their own session.

• Attack complexityDetail

  The exploit is reliable and condition-free; placing a crafted double-quote character in the $TMUX environment variable consistently breaks the shell quoting and injects arbitrary commands.

Blast Radius

• The injected command runs inside popen() under the PAM stack with root privileges, giving the attacker full control of the host operating system.
• An attacker reads any file on the system, including /etc/shadow, SSH private keys, application secrets, and credential stores.
• An attacker writes or overwrites any file, including sudoers entries, cron jobs, init scripts, or PAM configuration itself, achieving persistent root access.
• An attacker can terminate any process or corrupt system state, causing immediate denial of service for all users on the host.