GNU Inetutils telnetd Authentication Bypass (CVE-2026-24061)

The CVE record says telnetd in GNU Inetutils through version 2.7 allows remote authentication bypass via a "-f root" value for the USER environment variable. A remote attacker who can reach the telnet service can log in as root without a password. MITRE rates it CVSS 3.1 9.8 Critical, and the weakness is argument injection (CWE-88).

How the Bypass Works

GNU Inetutils maintainer Simon Josefsson published the advisory on 20 January 2026. It says telnetd runs /usr/bin/login, normally as root, and passes the client's USER value to it as the last parameter. The server does not sanitize that value.

The login program treats the -f option as "this user is already authenticated". A client that sets USER to "-f root" and connects with telnet's -a option is therefore logged in as root. The advisory shows a root shell on a test machine with telnetd enabled through inetd.

The advisory credits Kyu Neushwaistein, also known as Carlos Cortes Alvarez, who reported it on 19 January 2026. Paul Eggert wrote the first patch, and Josefsson extended it. It adds that other expanded variables may have similar problems, so the fix sanitizes all of them.

How Long the Bug Existed

The advisory says the bug came from a commit dated 19 March 2015. It first shipped in Inetutils 1.9.3, released on 12 May 2015. Every release from 1.9.3 up to and including 2.7 is affected, which is more than ten years of releases.

Exploitation and Public Tools

CISA added the flaw to KEV on 26 January 2026, with a due date of 16 February. NVD carries a CISA coordinator entry from 27 January that records exploitation as active, automatable as yes and technical impact as total. CISA lists ransomware use as unknown.

GreyNoise, a threat intelligence company, published its own honeypot data on 22 January 2026. It reports 60 sessions from 18 source IP addresses between 21 January 07:19 and 22 January 04:08. GreyNoise says most sessions tried to log in as root, and one source ran reconnaissance commands.

We read repository descriptions only and ran no code. They describe batch scanners, proofs of concept and lab setups, and what the authors claim is unverified. We link none of them. See our entry on known exploited vulnerabilities for what KEV listing means.

The CVE record and the advisory both give one affected range: GNU Inetutils from 1.9.3 up to and including 2.7. NVD matches the same range and also lists Debian 11 in its configuration. The record states no other product.

The advisory names no fixed release number. It points to two commits, fd702c02497b2f398e739e3119bed0b23dd7aa7b and ccba9f748aa8d50a38d7748e2e60362edd6a32cc, and says upgrading to a release that includes them also works. Check your distribution's package changelog for the CVE id rather than relying on the version string.

The advisory's example runs telnetd through inetd. In our reading, a host that never installed or enabled the Inetutils telnet server is not exposed through this bug. The record does not say which Linux distributions ship a vulnerable build, so we recommend asking your vendor.

Because the flaw sits in a network login service, it is the kind of internet-facing exposure our guide to defending against exploited vulnerabilities covers. Use it to plan the order of your fixes.