Every CVE Search/ Get API key

CVE-2026-24061

telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root" value...

9.8 CriticalIn KEVPublic exploitFix available

telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root" value for the USER environment variable.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

99.0%Up 98.6 points since Jan 21, 2026
90%50%10%1%

What each source reports

CVE List Score used 9.8

telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root" value for the USER environment variable.

Record
CVE-2026-24061
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-88
Updated
2026-11-02
EUVDEUVD-2026-3688 9.8

telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root" value for the USER environment variable.

Record
EUVD-2026-3688
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-pf97-p8ff-fj35 9.8

telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root" value...

telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root" value for the USER environment variable.

Record
GHSA-pf97-p8ff-fj35
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-88
Updated
2026-11-02
CISA KEV No score

GNU InetUtils Argument Injection Vulnerability

GNU InetUtils contains an argument injection vulnerability in telnetd that could allow for remote authentication bypass via a "-f root" value for the USER environment variable.

Record
CVE-2026-24061
Weakness
CWE-88
Updated
2026-11-02
NVD 9.8

telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root" value for the USER environment variable.

Record
CVE-2026-24061
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-88
Updated
2026-11-02
OSVALPINE-CVE-2026-24061 9.8

telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root" value for the USER environment variable.

Record
ALPINE-CVE-2026-24061
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-03
Show 5 moreShow less
OSV 9.8

telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root" value for the USER environment variable.

Record
CVE-2026-24061
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2026-24061 9.8

telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root" value for the USER environment variable.

Record
DEBIAN-CVE-2026-24061
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2026-24061 9.8

telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root" value for the USER environment variable.

Record
UBUNTU-CVE-2026-24061
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUSN-7992-1 No score

inetutils vulnerability

Kyu Neushwaistein discovered that telnetd in Inetutils incorrectly handled certain environment variables. A remote attacker could use this issue to bypass authentication and open a session as an administrator.

Record
USN-7992-1
Updated
2026-11-02
OSVUSN-7992-2 No score

inetutils vulnerability

USN-7992-1 fixed vulnerabilities in telnetd in Inetutils. This update provides the corresponding update for Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS.

Original advisory details:

Kyu Neushwaistein discovered that telnetd in Inetutils incorrectly handled certain environment variables. A remote attacker could use this issue to bypass authentication and open a session as an administrator.

Record
USN-7992-2
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
inetutils-telnet
Alpine:v3.24
 before 2.8-r0
2.8-r0
inetutils
Debian:12
 before 2:2.4-2+deb12u2, plus listed versions
2:2.4-22:2.4-2+deb12u1
2:2.4-2+deb12u2
inetutils
Debian:13
 before 2:2.6-3+deb13u1, plus listed versions
2:2.6-3
2:2.6-3+deb13u1
inetutils
Debian:14
 before 2:2.7-2, plus listed versions
2:2.6-32:2.6-42:2.7-1
2:2.7-2
inetutils
Debian:11
 before 2:2.0-1+deb11u3, plus listed versions
2:2.0-12:2.0-1+deb11u12:2.0-1+deb11u2
2:2.0-1+deb11u3
inetutils
Ubuntu:Pro:16.04:LTS
 before 2:1.9.4-1ubuntu0.1~esm5, plus listed versions
2:1.9.4-12:1.9.4-1build12:1.9.4-1ubuntu0.1~esm12:1.9.4-1ubuntu0.1~esm22:1.9.4-1ubuntu0.1~esm3
2:1.9.4-1ubuntu0.1~esm5
inetutils
Ubuntu:Pro:18.04:LTS
 before 2:1.9.4-3ubuntu0.1+esm4, plus listed versions
2:1.9.4-2build12:1.9.4-32:1.9.4-3ubuntu0.12:1.9.4-3ubuntu0.1+esm12:1.9.4-3ubuntu0.1+esm2
2:1.9.4-3ubuntu0.1+esm4
inetutils
Ubuntu:Pro:20.04:LTS
 before 2:1.9.4-11ubuntu0.2+esm3, plus listed versions
2:1.9.4-10build12:1.9.4-112:1.9.4-11ubuntu0.12:1.9.4-11ubuntu0.1+esm12:1.9.4-11ubuntu0.22:1.9.4-11ubuntu0.2+esm1
2:1.9.4-11ubuntu0.2+esm3
inetutils
Ubuntu:22.04:LTS
 before 2:2.2-2ubuntu0.2, plus listed versions
2:2.0-12:2.2-22:2.2-2ubuntu0.1
2:2.2-2ubuntu0.2
inetutils
Ubuntu:24.04:LTS
 before 2:2.5-3ubuntu4.1, plus listed versions
2:2.4-2ubuntu22:2.4-3ubuntu12:2.5-3ubuntu12:2.5-3ubuntu32:2.5-3ubuntu4
2:2.5-3ubuntu4.1
inetutils
Ubuntu:25.10
 before 2:2.6-1ubuntu3.1, plus listed versions
2:2.5-6ubuntu12:2.6-1ubuntu12:2.6-1ubuntu3
2:2.6-1ubuntu3.1

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
PoC in GitHubleonjza/inetutils-telnetd-auth-bypass2026-01-21
PoC in GitHubChocapikk/CVE-2026-240612026-01-22
PoC in GitHubJayGLXR/CVE-2026-24061-POC2026-01-22
PoC in GitHubSafeBreach-Labs/CVE-2026-240612026-01-22
PoC in GitHubTryA9ain/CVE-2026-240612026-01-22
PoC in GitHubduy-31/CVE-2026-24061---telnetd2026-01-22
PoC in GitHubh3athen/CVE-2026-240612026-01-22
PoC in GitHubparameciumzhang/Tell-Me-Root2026-01-22
PoC in GitHubbalgan/CVE-2026-240612026-01-23
PoC in GitHubmonstertsl/CVE-2026-240612026-01-23
Show 17 moreShow less
Public exploits
SourceLinkDate
PoC in GitHubr00tuser111/CVE-2026-240612026-01-23
PoC in GitHubsh4den/CVE-2026-240612026-01-23
PoC in GitHubxuemian168/CVE-2026-240612026-01-23
PoC in GitHub0p5cur/CVE-2026-24061-POC2026-01-24
PoC in GitHubAlter-N0X/CVE-2026-24061-POC2026-01-24
PoC in GitHubBrainBob/CVE-2026-240612026-01-24
PoC in GitHubBrainBob/Telnet-TestVuln-CVE-2026-240612026-01-24
PoC in GitHubMr-Zapi/CVE-2026-240612026-01-24
PoC in GitHubmadfxr/Twenty-Three-Scanner2026-01-24
PoC in GitHubmidox008/CVE-2026-240612026-01-24
PoC in GitHubshivam-bathla/CVE-2026-24061-setup2026-01-24
PoC in GitHubz3n70/CVE-2026-240612026-01-24
PoC in GitHubMefhika120/Ashwesker-CVE-2026-240612026-01-25
PoC in GitHubinfat0x/CVE-2026-240612026-01-25
PoC in GitHubms0x08-dev/CVE-2026-24061-POC2026-01-25
MetasploitGNU Inetutils Telnet Authentication Bypass Exploit CVE-2026-240612026-01-26
Exploit-DBGNU InetUtils 2.6 - Telnetd Remote Privilege Escalation2026-04-29

History

History
RecordedChangedSources
exploits_morePoC in GitHub
exploitation
affected, aliases, referencesOSV
exploits, exploits_more
first indexedCVE List, EUVD, Exploit-DB, GitHub Advisories, CISA KEV, Metasploit, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-24061 is a critical vulnerability (CVSS 9.8) in Gnu Inetutils, published January 21, 2026. CISA lists it as known to be exploited, since January 26, 2026. EUVD reports exploitation since January 26, 2026. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 99.0%, the 99th percentile. Fixed in inetutils-telnet 2.8-r0.

References

Show 16 moreShow less
This page doesn't list everything

The full exploit list has 41 more links.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open