CVE-2026-24061

GNU Inetutils telnetd, in all versions through 2.7, contains an argument injection flaw (CWE-88) in its handling of the USER environment variable: a remote, unauthenticated attacker who supplies a crafted value of "-f root" for USER during a telnet session can bypass authentication entirely. An attacker gains command execution as root on the target host with no credentials, yielding full compromise (CVSS 3.1: 9.8). Any Linux system or distribution shipping the affected telnetd is exposed — most notably Debian through its inetutils package — and reporting indicates the flaw has existed for roughly 11 years and is currently unpatched in all versions. Exploitation is confirmed in the wild: the flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2026-01-26, carries a 98% EPSS score (100th percentile), public PoC exploits exist, and GreyNoise has documented observed attacker activity against telnetd.

What to do: Inventory Linux hosts (especially Debian) for GNU Inetutils telnetd listening on port 23 and disable the telnet service or restrict it with firewall rules, since the flaw is reported unpatched in all versions through 2.7 and no fixed version is confirmed in the available data. As a CISA KEV entry (added 2026-01-26), apply vendor mitigations per BOD 22-01 guidance or discontinue use if mitigations are unavailable. Watch telnetd logs for sessions setting USER to values like "-f root", and monitor GNU/Debian channels for a patched release to deploy as soon as it appears.