jacubes/cve-2026-24061CVE-2026-24061 exploit PoC
⚠ This tool is created solely for educational use only. Unauthorized use outside of controlled environments is strictly prohibited.
CVE-2026-24061 is a critical vulnerability (CVSS 9.8) in telnetd from GNU Inetutils (versions 1.9.3–2.7) that allows a remote attacker to bypass authentication and gain root access by passing -f root through the USER environment variable. This tool is created to simulate abuse of this vulnerability
This PoC expects a target host address. There are two ways to provide it.
Simply insert your payload into target.txt.
host
The script will use address from this file.
Second option: You can add the target address through CLI. Run rce.py with a target host.
python rce.py <host> [-p <port>]
python rce.py
The vulnerability stems from improper handling of environment variables by telnetd. The service fails to sanitize the USER variable and allows injected command-line options to be interpreted as legitimate arguments.
This PoC connects to the target Telnet service and sends a crafted USER value containing the -f root option. When processed by the vulnerable telnetd instance, the daemon treats the injected parameter as a trusted login flag, bypassing authentication and granting a root shell if the target is vulnerable.
This tool is created solely for educational use only. Unauthorized use outside of controlled environments is strictly prohibited.