CVE-2026-48981Disclosure

LOWCVSS 6.7 · MEDIUM

Signal is active with 2 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

pam_usb provides hardware authentication for Linux using ordinary removable media. In versions prior to 0.9.2, pam_usb calls xmlReadFile() with flags=0 when loading the configuration file, allowing libxml2 to process external entity references (XXE), potentially making outbound network connections or local file reads at XML parse time from the context of the authenticating process. The vulnerability requires the configuration file to contain crafted XML entity references. Since pam_usb.conf is root-owned, direct exploitation requires prior write access to the config, but the defence-in-depth impact is significant given that pam_usb.so runs in setuid contexts (sudo, su). This issue has been fixed in version 0.9.2.

Back to dashboard

0.0/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-611

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

2 mentions across 1 observed day

What's happening

Technical details provided in 2 signals
Disclosure: 2 classified signals
2 total mentions across 1 day

Deep dive

Activity timeline2 mentions / 1d

Signal classification1 categories

Disclosure

2100.0%

Referenced assets2 URLs

By indicator

Full discourse2 posts

Infoflowcloud@infoflowcloud136d
Disclosure
🚨*CVE* CVE-2026-48981 pam_usb provides hardware authentication for Linux using ordinary removable media. In versions prior to 0.9.2, pam_usb calls xmlReadFile() with flags=0 when loading t… https://www.cve.org/CVERecord?id=CVE-2026-48981 ----- Traducción: CVE-2026-48981 pam… http://infoflow.cloud`
Post summary
The post briefly announces CVE-2026-48981, noting a flaw in pam_usb's use of xmlReadFile() before version 0.9.2, but it does not provide PoC, exploit details, patch information, or evidence of active exploitation.
0101135
82 followersView on X
CVE@CVEnew136d
Disclosure
CVE-2026-48981 pam_usb provides hardware authentication for Linux using ordinary removable media. In versions prior to 0.9.2, pam_usb calls xmlReadFile() with flags=0 when loading t… https://www.cve.org/CVERecord?id=CVE-2026-48981
Post summary
The post discloses that CVE‑2026‑48981 affects pam_usb versions before 0.9.2 due to xmlReadFile() called with flags=0, but it does not provide a PoC, exploit code, patch, or evidence of active exploitation.
00000231
57.6K followersView on X

Explore more

Back to dashboard