CVE-2026-24061
GNU InetUtils Argument Injection Vulnerability
Description
CVE-2026-24061 is a critical remote authentication bypass vulnerability in the telnetd component of GNU Inetutils through version 2.7. The vulnerability allows a remote attacker to bypass authentication entirely by passing a "-f root" value for the USER environment variable, which causes the telnet daemon to treat the connection as a trusted pre-authenticated session. With a CVSS v3.1 base score of 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), this is a trivially exploitable flaw that grants unauthenticated root access to affected systems. The vulnerability is listed in CISA's KEV catalog with a remediation deadline of February 16, 2026, and carries an EPSS score of 0.77919 (99.0th percentile), indicating very high exploitation probability.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorCWEs
Affected Products
| Vendor | Product | Version |
|---|---|---|
| gnu | inetutils | >= 1.9.3, <= 2.7 |
| debian | debian linux | 11.0 |
References
- https://codeberg.org/inetutils/inetutils/commit/ccba9f748aa8d50a38d7748e2e60362edd6a32cc(Patch)
- https://codeberg.org/inetutils/inetutils/commit/fd702c02497b2f398e739e3119bed0b23dd7aa7b(Patch)
- https://lists.gnu.org/archive/html/bug-inetutils/2026-01/msg00004.html(Mitigation, Vendor Advisory)
- https://www.gnu.org/software/inetutils/(Product)
- https://www.openwall.com/lists/oss-security/2026/01/20/2(Mailing List)
- https://www.openwall.com/lists/oss-security/2026/01/20/8(Mailing List)
- https://www.vicarius.io/vsociety/posts/cve-2026-24061-detection-script-remote-authentication-bypass-in-gnu-inetutils-package(Third Party Advisory)
- https://www.vicarius.io/vsociety/posts/cve-2026-24061-mitigation-script-remote-authentication-bypass-in-gnu-inetutils-package(Mitigation, Third Party Advisory)
- http://www.openwall.com/lists/oss-security/2026/01/22/1(Mailing List)
- https://lists.debian.org/debian-lts-announce/2026/01/msg00025.html(Mailing List, Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-24061(US Government Resource)
- https://www.labs.greynoise.io/grimoire/2026-01-22-f-around-and-find-out-18-hours-of-unsolicited-houseguests/index.html(Exploit, Third Party Advisory)
- https://www.openwall.com/lists/oss-security/2026/01/20/2#:~:[email protected]%3A~%20USER='(Mailing List, Third Party Advisory)
Weakness Type
CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
CVE-2026-24061 is classified under CWE-88, which describes software that constructs a command using externally supplied input but fails to properly neutralize special elements that could be interpreted as argument delimiters. In the context of GNU Inetutils telnetd, the USER environment variable received during the telnet connection negotiation is passed to the login process without adequate sanitization. When an attacker provides a value beginning with a dash character (such as "-f root"), the login program interprets it as a command-line flag rather than a username. The "-f" flag instructs login to bypass authentication for the specified user, granting immediate access as root without requiring a password. Learn more about CWE-88
Impact Analysis
Unauthenticated Remote Root Access is the direct consequence of CVE-2026-24061. An attacker who can reach the telnet service on a vulnerable system gains immediate root-level shell access without providing any credentials. This represents the most severe possible outcome of a network vulnerability.
Confidentiality Impact is maximum (C:H). Root access provides unrestricted read access to every file on the system, including shadow password files, private SSH keys, application credentials, database contents, and all user data. On servers, this typically exposes sensitive business data, customer information, and credentials for other systems.
Integrity Impact is maximum (I:H). With root access, the attacker has complete control over the system, enabling installation of rootkits, modification of system binaries, creation of backdoor accounts, alteration of audit logs, and any other changes. The attacker can embed persistent malware that survives reboots and make the system serve as a pivot point for attacking other network resources.
Availability Impact is maximum (A:H). Root access allows the attacker to shut down services, destroy data, encrypt the file system for ransom, or otherwise render the system completely unavailable. The simplicity of gaining access means that automated attacks could rapidly compromise and disable large numbers of vulnerable systems.
Affected Systems Scope: GNU Inetutils versions 1.9.3 through 2.7 are affected, along with Debian Linux 11.0 which packages the vulnerable telnetd. Any system running the GNU Inetutils telnetd daemon exposed to the network is at risk. While telnet usage has declined in favor of SSH, many legacy systems, embedded devices, and infrastructure equipment still run telnet services. The EPSS score of 0.77919 (99.0th percentile) and CISA's KEV listing confirm active exploitation. CISA lists the ransomware association as "Unknown."
Exploit Maturity
CVE-2026-24061 is confirmed as actively exploited in the wild, as reflected by its inclusion in CISA's KEV catalog with a remediation deadline of February 16, 2026. The EPSS score of 0.77919 places it in the 99.0th percentile, indicating it is among the most actively targeted vulnerabilities in the current landscape.
Trivial Exploitation: The vulnerability is exceptionally easy to exploit. An attacker simply connects to the telnet service and provides "-f root" as the username during the connection negotiation phase. No exploit code, buffer overflow payload, or sophisticated technique is required. A standard telnet client can be used to exploit this vulnerability in seconds, making it accessible to attackers of any skill level.
Public Disclosure and Technical Details: The vulnerability was disclosed through the GNU bug-inetutils mailing list and discussed extensively on the oss-security mailing list. Patches are available from the Inetutils Codeberg repository. Detection and mitigation scripts have been published by Vicarius.
Ransomware Association: CISA lists the ransomware association as "Unknown." However, the trivial nature of exploitation and immediate root access make this an extremely attractive target for ransomware operators seeking initial access to Linux-based infrastructure.
Remediation
-
Disable the telnet service immediately if it is not strictly required. This is the most effective mitigation because it eliminates the attack surface entirely. On systemd-based systems, run
systemctl stop telnetd && systemctl disable telnetd. On inetd/xinetd-based systems, comment out or remove the telnet entry from the configuration. The vast majority of modern environments should use SSH instead of telnet. -
Apply the upstream patches from the GNU Inetutils project if telnet must remain operational. Two commits address this vulnerability: ccba9f7 and fd702c0. Apply these patches to your installation and rebuild, or update to a patched version when released by your distribution.
-
Apply distribution-specific updates for Debian 11.0 and other affected distributions. Monitor your distribution's security tracker for updated inetutils packages that incorporate the upstream fix. On Debian, use
apt update && apt upgrade inetutils-telnetdwhen the patched package becomes available. -
Restrict telnet access using firewall rules as an immediate mitigation for systems where the service cannot be immediately disabled or patched. Block incoming connections to port 23 (or the configured telnet port) from all untrusted sources. Only allow telnet access from specific, trusted management networks using iptables, nftables, or your network firewall.
-
Migrate to SSH as a permanent solution. Replace all telnet usage with SSH, which provides encrypted communication, strong authentication, and is not affected by this class of argument injection vulnerability. For legacy systems or equipment that only support telnet, consider deploying a jump host or bastion server that provides SSH access and proxies telnet connections within a restricted network segment.
Technical Details
CVE-2026-24061 is a remote authentication bypass in the telnetd component of GNU Inetutils affecting versions 1.9.3 through 2.7. The vulnerability is an argument injection in the way telnetd processes the USER environment variable and passes it to the login program.
CVSS Vector Breakdown: The vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H yields a score of 9.8. The vulnerability is exploitable over the network (AV:N) with low complexity (AC:L). No privileges (PR:N) or user interaction (UI:N) are needed. The scope is unchanged (S:U), and all impact dimensions are maximum (C:H/I:H/A:H), reflecting the direct root-level access gained through exploitation.
Vulnerability Mechanism: During the telnet protocol negotiation phase, the client can set environment variables that are passed to the server. The GNU Inetutils telnetd implementation accepts the USER environment variable from the remote client and passes it to the system's login program as the username argument. When an attacker sets USER to "-f root", the telnetd daemon passes this value directly to login. The login program interprets the leading dash as a command-line option indicator, parsing "-f" as the "force login without password" flag and "root" as the target username. This causes login to grant an authenticated root shell without requesting or verifying any password.
Root Cause: The fundamental flaw is the failure to sanitize user-supplied input before using it as a command-line argument. The telnetd daemon should have validated the USER variable to ensure it does not begin with a dash character or contain other special characters that could be interpreted as command-line options by the login program. This is a classic argument injection vulnerability where the boundary between data and control information is not properly maintained.
Attack Simplicity: Exploitation requires nothing more than a telnet client. The attacker connects to the vulnerable service and, during the environment variable exchange phase of the telnet protocol, sets the USER variable to "-f root". The server processes this value without validation, and the attacker receives a root shell. No memory corruption, timing attacks, or other complex exploitation techniques are needed.
Historical Context: Similar argument injection vulnerabilities in telnet implementations have been discovered and exploited for decades. The persistence of this class of vulnerability in GNU Inetutils highlights the inherent risks of maintaining and running legacy network services that were designed before modern security practices were established.
Frequently Asked Questions
What is CVE-2026-24061?
CVE-2026-24061 is a critical remote authentication bypass in the telnetd component of GNU Inetutils versions 1.9.3 through 2.7. By sending "-f root" as the USER environment variable during a telnet connection, an attacker can bypass authentication and gain immediate root access to the system without any password.
How easy is it to exploit CVE-2026-24061?
This is one of the simplest critical vulnerabilities to exploit. An attacker needs only a standard telnet client to connect to the vulnerable service. There is no need for exploit code, shellcode, or any sophisticated technique. The entire exploitation can be accomplished in a single connection attempt, making it trivially automatable.
Should I still be running telnet in 2026?
In virtually all cases, no. Telnet transmits all data including credentials in plaintext and has a long history of security vulnerabilities. SSH provides encrypted, authenticated remote access and should be used instead. If you have legacy systems or equipment that require telnet, isolate them on a restricted network segment accessible only through a secured bastion host.
Is Debian 11 affected by CVE-2026-24061?
Yes. Debian Linux 11.0 is specifically listed as affected because it packages the vulnerable GNU Inetutils telnetd. However, the telnet service is not typically installed or enabled by default on Debian systems. Check for the inetutils-telnetd package with dpkg -l inetutils-telnetd and remove or update it if present.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.