Critical GNU InetUtils telnetd Flaw Lets Attackers Bypass Login and Gain Root Access
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-24061 | Argument Injection Authentication Bypass in GNU Inetutils telnetd GNU Inetutils telnetd, in all versions through 2.7, contains an argument injection flaw (CWE-88) in its handling of the USER environment variable: a remote, unauthenticated attacker who supplies a crafted value of "-f root" for USER during a telnet session can bypass authentication entirely. An attacker gains command execution as root on the target host with no credentials, yielding full compromise (CVSS 3.1: 9.8). Any Linux system or distribution shipping the affected telnetd is exposed — most notably Debian through its inetutils package — and reporting indicates the flaw has existed for roughly 11 years and is currently unpatched in all versions. Exploitation is confirmed in the wild: the flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2026-01-26, carries a 98% EPSS score (100th percentile), public PoC exploits exist, and GreyNoise has documented observed attacker activity against telnetd. Do: Inventory Linux hosts (especially Debian) for GNU Inetutils telnetd listening on port 23 and disable the telnet service or restrict it with firewall rules, since the flaw is reported unpatched in all versions through 2.7 and no fixed version is confirmed in the available data. As a CISA KEV entry (added 2026-01-26), apply vendor mitigations per BOD 22-01 guidance or discontinue use if mitigations are unavailable. Watch telnetd logs for sessions setting USER to values like "-f root", and monitor GNU/Debian channels for a patched release to deploy as soon as it appears. | 9.8 | 98% | KEV PoC ×4 |
| large≈10,000–100,000 internet-exposed telnetd instances (a subset of the several hundred thousand telnet port 23 devices observed in public internet scans); total… |
Full article483 words · extracted from thehackernews.com · click to collapse
Ravie LakshmananJan 22, 2026Vulnerability / Linux
A critical security flaw has been disclosed in the GNU InetUtils telnet daemon (telnetd) that went unnoticed for nearly 11 years.
The vulnerability, tracked as CVE-2026-24061, is rated 9.8 out of 10.0 on the CVSS scoring system. It affects all versions of GNU InetUtils from version 1.9.3 up to and including version 2.7.
"Telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a '-f root' value for the USER environment variable," according to a description of the flaw in the NIST National Vulnerability Database (NVD).
In a post on the oss-security mailing list, GNU contributor Simon Josefsson said the vulnerability can be exploited to gain root access to a target system -
The telnetd server invokes /usr/bin/login (normally running as root) passing the value of the USER environment variable received from the client as the last parameter.
If the client supply [sic] a carefully crafted USER environment value being the string "-f root", and passes the telnet(1) -a or --login parameter to send this USER environment to the server, the client will be automatically logged in as root bypassing normal authentication processes.
This happens because the telnetd server do [sic] not sanitize the USER environment variable before passing it on to login(1), and login(1) uses the -f parameter to by-pass normal authentication.
Josefsson also noted that the vulnerability was introduced as part of a source code commit made on March 19, 2015, which eventually made it to version 1.9.3 release on May 12, 2015. Security researcher Kyu Neushwaistein (aka Carlos Cortes Alvarez) has been credited with discovering and reporting the flaw on January 19, 2026.
As mitigations, it's advised to apply the latest patches and restrict network access to the telnet port to trusted clients. As temporary workarounds, users can disable telnetd server, or make the InetUtils telnetd use a custom login(1) tool that does not permit use of the '-f' parameter, Josefsson added.
Data gathered by threat intelligence firm GreyNoise shows that 21 unique IP addresses have been observed attempting to execute a remote authentication bypass attack by leveraging the flaw over the past 24 hours. All the IP addresses, which originate from Hong Kong, the U.S., Japan, the Netherlands, China, Germany, Singapore, and Thailand, have been flagged as malicious.
"Analysis of the combined sessions reveals a coordinated exploitation campaign targeting Telnet services (TCP/23) using the Inetutils telnetd -f authentication bypass vulnerability," the company said. "Post-exploitation activities include system reconnaissance, SSH key persistence, and malware deployment attempts."
Update
On January 26, 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-24061 to its Known Exploited Vulnerabilities (KEV) catalog, requiring Federal Civilian Executive Branch (FCEB) agencies to apply the patches by February 16, 2026.
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2026/01/critical-gnu-inetutils-telnetd-flaw.html