GNU InetUtils telnetd Authentication Bypass Lets Remote Attackers Gain Root

GNU InetUtils disclosed a high-severity authentication bypass in telnetd, tracked as CVE-2026-24061, that allows a remote attacker to obtain a root shell by abusing how the daemon invokes /usr/bin/login. In affected versions 1.9.3 through 2.7, telnetd passes the client-controlled USER environment variable without proper sanitization, enabling an attacker to supply values such as -f root and trigger login’s authentication-bypass behavior. The flaw was reportedly introduced by a 2015 code change, remained present for more than a decade, and carries a CVSS 9.8 severity rating.

GNU InetUtils published patches to sanitize variable expansions used in the login invocation, including a broader hardening change after the initial fix, and advised administrators to upgrade or apply the available patches immediately. Where patching is not possible, maintainers and CSIRT.SK recommended disabling telnetd, restricting Telnet access to trusted IP addresses, considering a login(1) implementation that rejects the -f flag, and reviewing logs for signs of compromise. CSIRT.SK also reported that GreyNoise observed exploitation attempts in the wild, increasing the urgency for exposed systems.