telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root"…
Priority CRITICAL 100Exploited in the wildCWE-88Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-88.
Summary
telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root" value for the USER environment variable.
Why it matters now
Exploitation Active In CISA KEV since 2026-01-26CISA due date 2026-02-16
EPSS 0.98984 99th percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Active
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| GNU | Inetutils | 1.9.3 – 2.7 | — | No fix listed | CNA |
- Inetutils VendorGNU Affected 1.9.3 – 2.7 Fixed in — No fix listed CNA
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-01-26 Added to CISA KEV
- 2026-10-02 Threatist record created from CVE-2026-24061
- 2026-10-03 Alias added: GHSA-pf97-p8ff-fj35
References
Exploit 2
Patch 2
Advisory 5
- https://lists.gnu.org/archive/html/bug-inetutils/2026-01/msg00004.html
- https://www.vicarius.io/vsociety/posts/cve-2026-24061-detection-script-remote-authentication-bypass-in-gnu-inetutils-package
- https://www.vicarius.io/vsociety/posts/cve-2026-24061-mitigation-script-remote-authentication-bypass-in-gnu-inetutils-package
- https://lists.debian.org/debian-lts-announce/2026/01/msg00025.html
- https://www.openwall.com/lists/oss-security/2026/01/20/2#:~:[email protected]%3A~%20USER='
More GNU Inetutils vulnerabilities
- TI-2011-04182 Buffer overflow in libtelnet/encrypt.c in telnetd in FreeBSD 7.3 through 9.0, MIT… CVSS 2.0HIGH 10.0
- TI-2026-25237 Buffer overflow in GNU inetutils CVSS 3.1CRITICAL 9.8
- TI-2026-22648 telnetd in GNU inetutils through 2.7 allows privilege escalation that can be exploited by… CVSS 3.1HIGH 7.8
- TI-2026-25261 telnet in GNU inetutils through 2.7 allows servers to read arbitrary environment… CVSS 3.1MEDIUM 4.7
- TI-2022-18420 telnetd in GNU Inetutils through 2.3, MIT krb5-appl through 1.0.3, and derivative works… CVSS 3.1HIGH 7.5
- TI-2023-21144 GNU inetutils before 2.5 may allow privilege escalation because of unchecked return… CVSS 3.1HIGH 7.8
Sources
- CVE-2026-24061 · CVE Program
- CVE-2026-24061 · NVD
- CISA Known Exploited Vulnerabilities
- FIRST EPSS
- GHSA-pf97-p8ff-fj35 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences