CVE-2026-28372: GNU inetutils telnetd Privilege Escalation

Professional Proof-of-Concept (PoC) for CVE-2026-28372, a Local Privilege Escalation (LPE) vulnerability found in GNU inetutils telnetd (versions ≤ 2.7).

Technical Summary

The vulnerability occurs because telnetd improperly passes client-controlled environment variables to the login(1) process. By manipulating the CREDENTIALS_DIRECTORY variable and inserting a login.noauth file, an unprivileged attacker can bypass authentication entirely and obtain a root shell without a password.

Vulnerability Details

• CVE ID: CVE-2026-28372
• Affected Software: GNU inetutils telnetd ≤ 2.7
• Required Condition: util-linux version supporting login.noauth
• Exploit Type: Authentication Bypass / Local Privilege Escalation (LPE)

Exploit Chain

1. Workspace Setup: Create a local directory containing a login.noauth file set to yes.
2. Environment Injection: Utilize the Telnet NEW-ENVIRON option to pass the malicious CREDENTIALS_DIRECTORY to the daemon.
3. Privilege Escalation: The telnetd service executes login(1), which reads the untrusted directory and grants root access.

Usage

Ensure the telnetd service is running and Python 3 is installed.

# Execute the automated exploit script
python3 exploit.py --host 127.0.0.1