critical9.8Known exploitedPublic exploit code
CVE-2026-24061
GNU InetUtils Argument Injection Vulnerability
Exploited in the wild
This vulnerability is on the CISA Known Exploited Vulnerabilities list, added 2026-01-26. Federal due date: 2026-02-16.
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- GNU InetUtils 2.6 - Telnetd Remote Privilege Escalation2026-04-29 · local · linux
Impact
GNU InetUtils contains an argument injection vulnerability in telnetd that could allow for remote authentication bypass via a "-f root" value for the USER environment variable.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Gnu | Inetutils | from 1.9.3 through 2.7 |
| Debian | Debian Linux | Version 11.0 |
Weakness classification
References
- NVD record
- CVE.org record
- CISA KEV catalog
- https://codeberg.org/inetutils/inetutils/commit/ccba9f748aa8d50a38d7748e2e60362edd6a32cc
- https://codeberg.org/inetutils/inetutils/commit/fd702c02497b2f398e739e3119bed0b23dd7aa7b
- https://lists.gnu.org/archive/html/bug-inetutils/2026-01/msg00004.html
- https://redteam.ae/blog/cve-2026-24061-inetutils-telnetd-root-bypass
- https://www.gnu.org/software/inetutils/
- https://www.openwall.com/lists/oss-security/2026/01/20/2
- https://www.openwall.com/lists/oss-security/2026/01/20/8
- https://www.vicarius.io/vsociety/posts/cve-2026-24061-detection-script-remote-authentication-bypass-in-gnu-inetutils-package
- https://www.vicarius.io/vsociety/posts/cve-2026-24061-mitigation-script-remote-authentication-bypass-in-gnu-inetutils-package
- http://www.openwall.com/lists/oss-security/2026/01/22/1
- https://lists.debian.org/debian-lts-announce/2026/01/msg00025.html
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-24061
- https://www.labs.greynoise.io/grimoire/2026-01-22-f-around-and-find-out-18-hours-of-unsolicited-houseguests/index.html
- https://www.openwall.com/lists/oss-security/2026/01/20/2#:~:text=root@...a%3A~%20USER='