Critical GNU InetUtils Telnet Flaw Enables Unauthenticated Root Login

A critical authentication bypass in GNU InetUtils telnetd, tracked as CVE-2026-24061 with a reported CVSS score of 9.8, allows remote attackers to obtain root access without credentials. Versions 1.9.3 through 2.7 pass the client-controlled TELNET USER environment variable to the system login utility without adequate sanitization, enabling attackers to inject a force-login argument that bypasses authentication. The flaw was introduced in March 2015 and shipped in May 2015, leaving affected versions vulnerable for more than a decade before public disclosure on January 20, 2026.

Beelzebub reported matching exploitation attempts against a honeypot emulating a vulnerable server on January 22, two days after disclosure. Over a 72-hour observation period, attempts came from 40 source IP addresses, with root representing 80% of attempted usernames; follow-on commands sought to verify privileges and identify the system. These observations demonstrate active targeting, not confirmed compromise of production systems, and infrastructure locations do not establish attacker attribution. Organizations should disable unnecessary telnetd services, restrict remaining Telnet access to trusted clients, and apply fixes or upgrade to GNU InetUtils 2.8, which rejects USER values beginning with a hyphen. The advisory also describes broader sanitization of login-invocation variables; legacy deployments warrant network isolation, monitoring, and replacement planning.