Description
telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root" value for the USER environment variable.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| GNU | Inetutils | 1.9.3 – ≤ 2.7 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | inetutils | 2:2.7-2 | — |
| Debian 13 | inetutils | 2:2.6-3+deb13u1 | DSA-6106-1 |
| Debian 12 | inetutils | 2:2.4-2+deb12u2 | DSA-6106-1 |
| Debian 11 | inetutils | 2:2.0-1+deb11u3 | DLA-4453-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 25.10 | inetutils | 2:2.6-1ubuntu3.1 | USN-7992-1 |
| Ubuntu 24.04 LTS | inetutils | 2:2.5-3ubuntu4.1 | USN-7992-1 |
| Ubuntu 22.04 LTS | inetutils | 2:2.2-2ubuntu0.2 | USN-7992-1 |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 20.04 LTS | inetutils | 2:1.9.4-11ubuntu0.2+esm3 | — |
| Ubuntu Pro 18.04 LTS | inetutils | 2:1.9.4-3ubuntu0.1+esm4 | — |
| Ubuntu Pro 16.04 LTS | inetutils | 2:1.9.4-1ubuntu0.1~esm5 | — |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | inetutils-telnet | 2.8-r0 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Metasploit 1 module
-
GNU Inetutils Telnet Authentication Bypass Exploit CVE-2026-24061
exploit/linux/telnet/gnu_inetutils_auth_bypass
Exploit-DB 1
- GNU InetUtils 2.6 - Telnetd Remote Privilege Escalation EDB-52524 · local · Apr 29, 2026
GitHub 66 repositories · most starred shown
-
SafeBreach-Labs/CVE-2026-24061 ★ 208 · Jan 22, 2026
Exploitation of CVE-2026-24061
-
JayGLXR/CVE-2026-24061-POC ★ 69 · Jan 22, 2026
-
parameciumzhang/Tell-Me-Root ★ 21 · Jan 22, 2026
基于cve-2026-24061 telnet远程认证绕过漏洞的批量检测利用工具
-
Lingzesec/CVE-2026-24061-GUI ★ 17 · Jan 26, 2026
CVE-2026-24061 GNU Inetutils telnetd 身份验证绕过漏洞检测与利用 GUI 工具
-
ekomsSavior/telnet_scan ★ 12 · Mar 26, 2026
scanner/exploiter CVE-2026-24061 & CVE-2026-32746
-
leonjza/inetutils-telnetd-auth-bypass ★ 12 · Jan 21, 2026
A small docker lab to play with cve-2026-24061, the inetutils-telnetd authentication bypass.
-
Chocapikk/CVE-2026-24061 ★ 11 · Jan 22, 2026
-
0p5cur/CVE-2026-24061-POC ★ 10 · Jan 24, 2026
CVE-2026-24061's poc : a critical authentication bypass in telnetd leading to RCE as root Affects systems with telnetd versions containing the vulnerability from 2015 onwards.
-
TryA9ain/CVE-2026-24061 ★ 9 · Jan 22, 2026
CVE-2026-24061 Batch Scanning Tool
-
tc4dy/CVE-2026-24061-PoC-Exploit ★ 8 · Jun 6, 2026
CVE-2026-24061 - GNU inetutils-telnetd Auth Bypass Exploit - Full Control with CRLF injection via NEW_ENVIRON leads to auth bypass & instant root shell. Single/Mass exploitation, multi-threading, cus…
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 5
- WID-SEC-2026-0183 InetUtils (telnetd): Schwachstelle ermöglicht Erlangen von Administratorrechten BSI CERT-Bund (WID) · Apr 14, 2026
- USN-7992-1 inetutils vulnerability Ubuntu Security Notices (USN) · Feb 10, 2026
- DLA-4453-1 inetutils - security update Debian Security (DSA / DLA) · Jan 25, 2026
- DSA-6106-1 inetutils - security update Debian Security (DSA / DLA) · Jan 22, 2026
- NCSC-2026-0033 Kwetsbaarheid verholpen in GNU Inetutils telnetd NCSC-NL (Netherlands) · Jan 21, 2026
References
- https://www.openwall.com/lists/oss-security/2026/01/20/2
- https://www.openwall.com/lists/oss-security/2026/01/20/8
- https://www.gnu.org/software/inetutils/
- https://lists.gnu.org/archive/html/bug-inetutils/2026-01/msg00004.html
- https://codeberg.org/inetutils/inetutils/commit/fd702c02497b2f398e739e3119bed0b23dd7aa7b
- https://codeberg.org/inetutils/inetutils/commit/ccba9f748aa8d50a38d7748e2e60362edd6a32cc
- https://www.vicarius.io/vsociety/posts/cve-2026-24061-detection-script-remote-authentication-bypass-in-gnu-inetutils-package
- https://www.vicarius.io/vsociety/posts/cve-2026-24061-mitigation-script-remote-authentication-bypass-in-gnu-inetutils-package
- https://redteam.ae/blog/cve-2026-24061-inetutils-telnetd-root-bypass