Loading story…
GNU InetUtils disclosed a high-severity authentication bypass in telnetd, tracked as CVE-2026-24061, that allows a remote attacker to obtain a root shell by abusing how the daemon invokes /usr/bin/login. In affected versions 1.9.3 through 2.7, telnetd passes the client-controlled USER environment variable without proper sanitization, enabling an attacker to supply values such as -f root and trigger login’s authentication-bypass behavior. The flaw was reportedly introduced by a 2015 code change, remained present for more than a decade, and carries a CVSS 9.8 severity rating.
GNU InetUtils published patches to sanitize variable expansions used in the login invocation, including a broader hardening change after the initial fix, and advised administrators to upgrade or apply the available patches immediately. Where patching is not possible, maintainers and CSIRT.SK recommended disabling telnetd, restricting Telnet access to trusted IP addresses, considering a login(1) implementation that rejects the -f flag, and reviewing logs for signs of compromise. CSIRT.SK also reported that GreyNoise observed exploitation attempts in the wild, increasing the urgency for exposed systems.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
CSIRT.SK reported that GreyNoise observed exploitation attempts targeting the telnetd vulnerability in the wild, indicating active attacker interest in the flaw.
The vulnerable code started shipping with GNU InetUtils version 1.9.3 in May 2015, beginning the affected range that continued through version 2.7.
On 2026-01-20, patches were developed and improved to sanitize variable expansions used when constructing the login invocation in telnetd.
GNU InetUtils states the vulnerability was reported on 2026-01-19. The issue allows a remote attacker to supply a crafted USER value such as "-f root" to bypass authentication and obtain root access.
The authentication-bypass flaw was introduced by a commit on March 19, 2015, when telnetd began passing client-controlled data into the login invocation without proper sanitization.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
csirt.sk
Open sourcecodeberg.org
Open sourceseclists.org
Open sourcecodeberg.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
GNU InetUtils disclosed **CVE-2026-24061**, a high-severity authentication bypass in `telnetd` that can let a remote client obtain **root** access without valid credentials. The bug affects versions **1.9.3 through 2.7** and stems from `telnetd` passing a client-controlled `USER` environment variable to `/usr/bin/login` without sanitization; a crafted value such as `-f root` can cause `login(1)` to skip normal authentication. The vulnerable code path was traced to a 2015 commit later shipped in the 1.9.3 release, and maintainers published patches while advising organizations not to run `telnetd`, to restrict access to trusted clients, and to upgrade to a fixed release. Public attention quickly expanded beyond the advisory as security researchers and developers published multiple **proof-of-concept exploits, scanners, Nuclei templates, test harnesses, and detection content** on GitHub and in vendor repositories. Those references describe tooling for discovery and exploitation of the `NEW_ENVIRON`/`USER` injection path, including lab environments and root-shell demonstrations, increasing the likelihood of opportunistic targeting against exposed Telnet services. The combination of a remotely reachable root bypass and rapidly available offensive tooling makes internet-facing or internally exposed GNU InetUtils `telnetd` instances an urgent remediation priority.
Jun 29, 2026
A critical authentication-bypass vulnerability was disclosed in **GNU InetUtils `telnetd`** that allows a remote, unauthenticated attacker to obtain access as **root** (or any known user) by supplying a crafted `USER` environment variable. The issue arises because `telnetd` passes the remote-supplied `USER` value to `/usr/bin/login` without sanitization; an attacker can set `USER` to `-f root`, leveraging the `login(1)` `-f` option to bypass normal authentication checks and immediately gain privileged access. Reported by **Simon Josefsson**, the flaw appears to have been introduced in 2015 and affects **GNU InetUtils versions 1.9.3 and later** (with reporting indicating impact through at least **2.7**); at the time of reporting, **no CVE** had been assigned. Mitigations emphasized include **disabling Telnet** (preferred due to the protocol’s inherent insecurity), restricting access to trusted clients via network controls, and applying upstream fixes where available. Operationally, defenders are advised to rapidly identify exposed services—particularly Linux systems running Telnet—because exploitation requires only network reachability to `telnetd` and results in full system compromise; one approach suggested for discovery is querying asset inventories for Linux hosts offering Telnet (e.g., `os:Linux protocol:telnet`) and then validating which implementation is in use before prioritizing remediation.
Jun 29, 2026
Researchers disclosed **CVE-2026-32746**, a critical `telnetd` vulnerability in **GNU Inetutils** that allows an unauthenticated remote attacker to achieve **root remote code execution** by exploiting a buffer overflow in the **LINEMODE SLC (Set Local Characters)** option handler. The flaw affects GNU Inetutils `telnetd` through version `2.7`, carries a **CVSS 9.8**, and can be triggered during the initial Telnet handshake on **port 23** before any login prompt appears, requiring no credentials, no user interaction, and no special network position. The issue was discovered and reported by **Dream** on March 11, 2026, and GNU maintainers reportedly confirmed the finding, with a fix expected by **April 1, 2026**. Both reports warn that successful exploitation can lead to full system compromise because `telnetd` often runs with elevated privileges, enabling follow-on activity such as persistent backdoors, data theft, and lateral movement. The risk is especially acute in **legacy environments** where Telnet remains in use, including **ICS/OT, PLC, SCADA, and some government systems**, even though public reporting has not yet indicated active exploitation in the wild.
Jul 1, 2026