CVE-2026-24061: GNU Inetutils telnetd argument injection allows remote auth bypass

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: high.

critical priorityUnauthenticated remote root compromise with a CVSS of 9.8, KEV listing and near-maximum EPSS makes this an urgent patch-or-disable case.

What it is

telnetd in GNU Inetutils through 2.7 fails to sanitize the USER environment variable, so a value such as "-f root" is passed as an argument to login and bypasses authentication. Because telnetd is network-facing and the flaw needs no credentials, any reachable instance is at risk of full compromise.

Impact

An unauthenticated remote attacker gains a root shell on the host, giving full control over confidentiality, integrity and availability of the system and anything it can reach.

Attack surface

Reachable over the network via the telnet service (AV:N, PR:N, UI:N); no authentication or user interaction is required, only the ability to connect to the telnetd port and supply a crafted USER value.

Exploitation

Listed in CISA KEV with a 2026-02-16 remediation due date, and EPSS is 0.97993 (99.9th percentile); a public exploit write-up is referenced, indicating active exploitation.

What to do

• Apply the vendor patches referenced in the Inetutils commits and update to a fixed release; Debian users should follow the Debian LTS advisory.
• If patching is not immediately possible, disable or block telnetd, restrict TCP/23 to trusted management networks, and follow the GNU vendor mitigation guidance.
• Treat any internet-exposed telnetd as compromised: rotate credentials and keys and review the host for persistence.
• Where telnet is still required, replace it with SSH and remove telnetd from the environment.

Detection

• Inspect telnetd and login process command lines and logs for USER values containing "-f" or "root".
• Alert on inbound connections to TCP/23 from untrusted networks and on successful logins to telnetd without a preceding authentication exchange.
• Hunt for unexpected root sessions or new processes spawned from telnetd on hosts running Inetutils.
• Monitor for post-exploitation activity such as new accounts, SSH key additions, or cron/systemd persistence on telnet-exposed hosts.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.