11-Year-Old critical telnetd flaw found in GNU InetUtils (CVE-2026
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-24061 | Argument Injection Authentication Bypass in GNU Inetutils telnetd GNU Inetutils telnetd, in all versions through 2.7, contains an argument injection flaw (CWE-88) in its handling of the USER environment variable: a remote, unauthenticated attacker who supplies a crafted value of "-f root" for USER during a telnet session can bypass authentication entirely. An attacker gains command execution as root on the target host with no credentials, yielding full compromise (CVSS 3.1: 9.8). Any Linux system or distribution shipping the affected telnetd is exposed — most notably Debian through its inetutils package — and reporting indicates the flaw has existed for roughly 11 years and is currently unpatched in all versions. Exploitation is confirmed in the wild: the flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2026-01-26, carries a 98% EPSS score (100th percentile), public PoC exploits exist, and GreyNoise has documented observed attacker activity against telnetd. Do: Inventory Linux hosts (especially Debian) for GNU Inetutils telnetd listening on port 23 and disable the telnet service or restrict it with firewall rules, since the flaw is reported unpatched in all versions through 2.7 and no fixed version is confirmed in the available data. As a CISA KEV entry (added 2026-01-26), apply vendor mitigations per BOD 22-01 guidance or discontinue use if mitigations are unavailable. Watch telnetd logs for sessions setting USER to values like "-f root", and monitor GNU/Debian channels for a patched release to deploy as soon as it appears. | 9.8 | 98% | KEV PoC ×4 |
| large≈10,000–100,000 internet-exposed telnetd instances (a subset of the several hundred thousand telnet port 23 devices observed in public internet scans); total… |
Full article302 words · extracted from securityaffairs.com · click to collapse
Critical telnetd flaw CVE-2026-24061 (CVSS 9.8) affects all GNU InetUtils versions 1.9.3–2.7 and went unnoticed for nearly 11 years.
A critical vulnerability, tracked as CVE-2026-24061 (CVSS score of 9.8), in the GNU InetUtils telnet daemon (telnetd) impacts all versions from 1.9.3 to 2.7. The vulnerability can be exploited to gain root access on affected systems.
Telnetd is a server implementing the DARPA Telnet protocol, typically launched by inetd to handle connections on the Telnet port, with options to run manually in debug mode or on alternate TCP ports.
The vulnerability was introduced as part of a source code commit made on March 19, 2015. The flaw remained undiscovered for nearly 11 years, posing long-standing security risks.
“The telnetd server invokes /usr/bin/login (normally running as root) passing the value of the USER environment variable received from the client as the last parameter. If the client supply a carefully crafted USER environment value being the string “-f root”, and passes the telnet(1) -a or –login parameter to send this USER environment to the server, the client will be automatically logged in as root bypassing normal authentication processes.” reads the advisory. “This happens because the telnetd server do not sanitize the USER environment variable before passing it on to login(1), and login(1) uses the -f parameter to by-pass normal authentication.”
Security researcher Kyu Neushwaistein (aka Carlos Cortes Alvarez) reported the flaw on January 19, 2026.
To mitigate the flaw, apply the latest patches and restrict access to the telnet service to trusted clients. Disable the telnetd server if possible, or configure it to use a custom login tool that prevents use of the “-f” option.
Cybersecurity firm GreyNoise already observed exploitation attempts for this flaw.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, GNU InetUtils)
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/187255/security/11-year-old-critical-telnetd-flaw-found-in-gnu-inetutils-cve-2026-24061.html