Skip to content
OpenAdvisories
High · 7.4 Public exploit CVE-2026-28372 EUVD-2026-9000GHSA-j682-47rx-fxrp

telnetd in GNU inetutils through 2.7 allows privilege escalation that can be exploited by abusing systemd service credentials support added…

Published Feb 27, 2026 · Updated Mar 7, 2026 · Assigned by mitre

Vendor: GNU Product: Inetutils Package: inetutils Package: inetutils Package: inetutils-telnet Ecosystem: Alpine Ecosystem: Debian Ecosystem: Ubuntu

Description

telnetd in GNU inetutils through 2.7 allows privilege escalation that can be exploited by abusing systemd service credentials support added to the login(1) implementation of util-linux in release 2.40. This is related to client control over the CREDENTIALS_DIRECTORY environment variable, and requires an unprivileged local user to create a login.noauth file.

Affected products

VendorProductAffectedFixed
GNU inetutils ≤ 2.7 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 inetutils 2:2.7-3 —
Debian 13 inetutils 2:2.6-3+deb13u2 DSA-6144-1
Debian 12 inetutils 2:2.4-2+deb12u3 —

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 26.04 LTS inetutils 2:2.7-2ubuntu1.1 USN-8387-1
Ubuntu 25.10 inetutils 2:2.6-1ubuntu3.2 USN-8387-1
Ubuntu 24.04 LTS inetutils 2:2.5-3ubuntu4.2 USN-8387-1
Show 5 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 22.04 LTS inetutils 2:2.2-2ubuntu0.2+esm1 USN-8387-1
Ubuntu Pro 20.04 LTS inetutils 2:1.9.4-11ubuntu0.2+esm4 USN-8387-1
Ubuntu Pro 18.04 LTS inetutils 2:1.9.4-3ubuntu0.1+esm5 USN-8387-1
Ubuntu Pro 16.04 LTS inetutils 2:1.9.4-1ubuntu0.1~esm6 USN-8387-1
Ubuntu Pro 14.04 LTS inetutils 2:1.9.2-1ubuntu0.1~esm4 USN-8387-1

Alpine

Security tracker ↗
ReleasePackageFixed inAdvisory
Alpine v3.24 inetutils-telnet 2.8-r0 —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 3 repositories

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Advisories 3

References