Critical GNU InetUtils Telnetd Vulnerability Allows Root Access via Authentication Bypass
- Securityish
- Threats & Incidents
Quick Summary
A critical vulnerability, tracked as CVE-2026-24061, has been discovered in the GNU InetUtils telnet daemon, allowing attackers to bypass authentication and gain root access. This flaw affects all versions from 1.9.3 to 2.7 and has a CVSS score of 9.8. Discovered by Kyu Neushwaistein on January 19, 2026, the vulnerability has been exploited by 21 unique IP addresses attempting attacks within a day, highlighting significant security risks for affected systems.
The Securityish Brief
The GNU InetUtils telnet daemon (telnetd) has a critical security flaw that has gone unnoticed for nearly 11 years. This vulnerability, identified as CVE-2026-24061, is rated 9.8 out of 10 on the CVSS scale, indicating its severity. It affects all versions of GNU InetUtils from 1.9.3 up to and including version 2.7. The flaw allows remote authentication bypass by manipulating the USER environment variable.
Specifically, if an attacker sends a crafted USER value of ‘-f root’ along with the telnet login parameter, they can bypass normal authentication and gain root access. This issue arises because the telnetd server fails to sanitize the USER variable before passing it to the login process, which uses the ‘-f’ parameter to skip authentication.
The vulnerability was introduced in a code commit on March 19, 2015, and was included in the 1.9.3 release on May 12, 2015. Security researcher Kyu Neushwaistein reported the flaw on January 19, 2026, prompting immediate attention from the cybersecurity community.
In the past 24 hours, threat intelligence firm GreyNoise has reported that 21 unique IP addresses from various countries, including the U.S., Japan, and Germany, have attempted to exploit this vulnerability. These IPs have been flagged as malicious, indicating that attackers are actively seeking to exploit this flaw.
Understanding the Risks
This vulnerability poses significant risks to organizations using affected versions of GNU InetUtils. If exploited, attackers can gain complete control over systems, leading to potential data breaches, system compromises, and further attacks. Organizations must prioritize patching and securing their systems to mitigate these risks.
Mitigations include applying the latest patches and restricting access to the telnet port to trusted clients. As a temporary measure, users can disable the telnetd server or configure it to use a custom login tool that does not allow the ‘-f’ parameter. These steps are crucial to prevent unauthorized access and protect sensitive information.
Key Takeaways
- Apply the latest patches for GNU InetUtils to address the critical vulnerability.
- Restrict network access to the telnet port, allowing only trusted clients.
- Consider disabling the telnetd server if it is not essential for operations.
- Implement a custom login tool that does not permit the use of the ‘-f’ parameter.
- Monitor network traffic for unusual activity related to telnet access attempts.
Key Terms & Concepts
- CVE-2026-24061: In this article, CVE-2026-24061 refers to a critical vulnerability in the GNU InetUtils telnet daemon that allows authentication bypass.
- GNU InetUtils: GNU InetUtils is a collection of common network programs, including the telnet daemon, used in Unix-like operating systems.
- CVSS: CVSS stands for Common Vulnerability Scoring System, which rates the severity of security vulnerabilities on a scale from 0 to 10.
- telnetd: Telnetd is a daemon that allows remote users to connect to a server using the Telnet protocol.
Read the original article here: https://thehackernews.com/2026/01/critical-gnu-inetutils-telnetd-flaw.html
Your 5-Minute Securityish Brief
A weekly digest of cybersecurity news, phishing alerts, privacy tips, and emerging threats, simplified so anyone can understand what matters and why.
Securityish
Securityish explains cybersecurity, scams, data breaches, and privacy risks in simple language so you know what’s happening and how to protect yourself.
© 2026 Securityish
