GNU InetUtils telnetd flaw lets remote attackers log in as root

GNU InetUtils disclosed CVE-2026-24061, a high-severity authentication bypass in telnetd that can let a remote client obtain root access without valid credentials. The bug affects versions 1.9.3 through 2.7 and stems from telnetd passing a client-controlled USER environment variable to /usr/bin/login without sanitization; a crafted value such as -f root can cause login(1) to skip normal authentication. The vulnerable code path was traced to a 2015 commit later shipped in the 1.9.3 release, and maintainers published patches while advising organizations not to run telnetd, to restrict access to trusted clients, and to upgrade to a fixed release.

Public attention quickly expanded beyond the advisory as security researchers and developers published multiple proof-of-concept exploits, scanners, Nuclei templates, test harnesses, and detection content on GitHub and in vendor repositories. Those references describe tooling for discovery and exploitation of the NEW_ENVIRON/USER injection path, including lab environments and root-shell demonstrations, increasing the likelihood of opportunistic targeting against exposed Telnet services. The combination of a remotely reachable root bypass and rapidly available offensive tooling makes internet-facing or internally exposed GNU InetUtils telnetd instances an urgent remediation priority.