Loading story…
A critical authentication-bypass vulnerability was disclosed in GNU InetUtils telnetd that allows a remote, unauthenticated attacker to obtain access as root (or any known user) by supplying a crafted USER environment variable. The issue arises because telnetd passes the remote-supplied USER value to /usr/bin/login without sanitization; an attacker can set USER to -f root, leveraging the login(1) -f option to bypass normal authentication checks and immediately gain privileged access. Reported by Simon Josefsson, the flaw appears to have been introduced in 2015 and affects GNU InetUtils versions 1.9.3 and later (with reporting indicating impact through at least 2.7); at the time of reporting, no CVE had been assigned.
Mitigations emphasized include disabling Telnet (preferred due to the protocol’s inherent insecurity), restricting access to trusted clients via network controls, and applying upstream fixes where available. Operationally, defenders are advised to rapidly identify exposed services—particularly Linux systems running Telnet—because exploitation requires only network reachability to telnetd and results in full system compromise; one approach suggested for discovery is querying asset inventories for Linux hosts offering Telnet (e.g., os:Linux protocol:telnet) and then validating which implementation is in use before prioritizing remediation.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
9 events from the most recent confirmed update back to the earliest known activity.
SafeBreach Labs released a technical analysis and public Python proof-of-concept showing how the %U placeholder and Telnet environment handling enable argument injection into login. The research also noted attackers could influence additional environment variables such as PATH and recommended upgrading to the patched release.
Security reporting on 2026-01-23 described a coordinated campaign exploiting CVE-2026-24061, with observed reconnaissance, SSH key persistence attempts, and failed Python malware deployment after initial access. The activity appeared largely automated and focused on quickly turning unauthenticated access into root-level persistence.
By 2026-01-22, multiple national cybersecurity authorities and security vendors were warning that exploitation was straightforward and recommending decommissioning telnet, migrating to SSH, patching, or tightly restricting access. Public reporting also highlighted active scanning and exploitation attempts from multiple IPs shortly after disclosure.
GreyNoise observed malicious exploitation activity starting on 2026-01-21, with attackers using Telnet option negotiation to inject USER values and obtain shell access. Reporting described 18 attacker IPs across 60 sessions, with root targeted in most cases.
GNU InetUtils 2.8 was released to patch the telnetd authentication bypass vulnerability. Guidance accompanying coverage recommended upgrading immediately or disabling telnetd and restricting TCP/23 access where patching was not possible.
The critical telnetd flaw was publicly disclosed as CVE-2026-24061, with a CVSS score of 9.8, describing how a crafted USER value such as "-f root" can bypass authentication and yield root access. Public reporting on 2026-01-20 also noted affected versions beginning at 1.9.3.
Security researcher Kyu Neushwaistein (Carlos Cortes Alvarez) reported the GNU InetUtils telnetd authentication bypass issue. Multiple sources place the report on 2026-01-19.
GNU InetUtils version 1.9.3 was released with the vulnerable telnetd behavior, making affected versions start at 1.9.3. The bug then persisted across subsequent releases up to 2.7.
A source code change on 2015-03-19 introduced the telnetd argument-injection flaw by allowing client-controlled USER data to be passed into the login invocation. This created the basis for later authentication bypass and root access.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
16 references tracked. Mallory keeps watching after this page renders.
safebreach.com
Open sourcedarkreading.com
Open sourcebleepingcomputer.com
Open sourcecybersecuritynews.com
Open sourcecybersecuritynews.com
Open sourcesecurityonline.info
Open sourcerunzero.com
Open sourcerunzero.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
GNU InetUtils disclosed **CVE-2026-24061**, a high-severity authentication bypass in `telnetd` that can let a remote client obtain **root** access without valid credentials. The bug affects versions **1.9.3 through 2.7** and stems from `telnetd` passing a client-controlled `USER` environment variable to `/usr/bin/login` without sanitization; a crafted value such as `-f root` can cause `login(1)` to skip normal authentication. The vulnerable code path was traced to a 2015 commit later shipped in the 1.9.3 release, and maintainers published patches while advising organizations not to run `telnetd`, to restrict access to trusted clients, and to upgrade to a fixed release. Public attention quickly expanded beyond the advisory as security researchers and developers published multiple **proof-of-concept exploits, scanners, Nuclei templates, test harnesses, and detection content** on GitHub and in vendor repositories. Those references describe tooling for discovery and exploitation of the `NEW_ENVIRON`/`USER` injection path, including lab environments and root-shell demonstrations, increasing the likelihood of opportunistic targeting against exposed Telnet services. The combination of a remotely reachable root bypass and rapidly available offensive tooling makes internet-facing or internally exposed GNU InetUtils `telnetd` instances an urgent remediation priority.
Jun 29, 2026
GNU InetUtils disclosed a high-severity authentication bypass in `telnetd`, tracked as **CVE-2026-24061**, that allows a remote attacker to obtain a root shell by abusing how the daemon invokes `/usr/bin/login`. In affected versions **1.9.3 through 2.7**, `telnetd` passes the client-controlled `USER` environment variable without proper sanitization, enabling an attacker to supply values such as `-f root` and trigger login’s authentication-bypass behavior. The flaw was reportedly introduced by a 2015 code change, remained present for more than a decade, and carries a **CVSS 9.8** severity rating. GNU InetUtils published patches to sanitize variable expansions used in the login invocation, including a broader hardening change after the initial fix, and advised administrators to upgrade or apply the available patches immediately. Where patching is not possible, maintainers and CSIRT.SK recommended disabling `telnetd`, restricting Telnet access to trusted IP addresses, considering a `login(1)` implementation that rejects the `-f` flag, and reviewing logs for signs of compromise. CSIRT.SK also reported that **GreyNoise observed exploitation attempts in the wild**, increasing the urgency for exposed systems.
Jul 24, 2026
Researchers disclosed **CVE-2026-32746**, a critical `telnetd` vulnerability in **GNU Inetutils** that allows an unauthenticated remote attacker to achieve **root remote code execution** by exploiting a buffer overflow in the **LINEMODE SLC (Set Local Characters)** option handler. The flaw affects GNU Inetutils `telnetd` through version `2.7`, carries a **CVSS 9.8**, and can be triggered during the initial Telnet handshake on **port 23** before any login prompt appears, requiring no credentials, no user interaction, and no special network position. The issue was discovered and reported by **Dream** on March 11, 2026, and GNU maintainers reportedly confirmed the finding, with a fix expected by **April 1, 2026**. Both reports warn that successful exploitation can lead to full system compromise because `telnetd` often runs with elevated privileges, enabling follow-on activity such as persistent backdoors, data theft, and lateral movement. The risk is especially acute in **legacy environments** where Telnet remains in use, including **ICS/OT, PLC, SCADA, and some government systems**, even though public reporting has not yet indicated active exploitation in the wild.
Jul 1, 2026