CVE-2026-24061
Gnu Inetutils 1.9.3 – 2.7
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HSummary
CVE-2026-24061 is a critical-severity Argument Injection (CWE-88) vulnerability in Gnu Inetutils. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Command and Scripting Interpreter (T1059); ranked in the top 0.1% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SI-10 (Information Input Validation) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-24061 is a high-severity vulnerability (CVSS 9.8) in the telnetd daemon of GNU Inetutils versions through 2.7, stemming from CWE-88 (improper neutralization of argument delimiters). It enables remote authentication bypass by setting the USER environment variable to "-f root", allowing attackers to circumvent login credentials without proper validation of the input.
Any unauthenticated remote attacker with network access to the telnetd service can exploit this vulnerability with low complexity and no user interaction required. Successful exploitation grants high-impact privileges, potentially including root-level access, resulting in complete compromise of confidentiality, integrity, and availability (C:H/I:H/A:H) on the affected system.
Mitigation involves applying patches from upstream commits, such as ccba9f748aa8d50a38d7748e2e60362edd6a32cc and fd702c02497b2f398e739e3119bed0b23dd7aa7b on Codeberg, which address the authentication flaw. Advisories on GNU bug-inetutils and oss-security mailing lists detail the issue and fixes, with further details available on the GNU Inetutils project page; security practitioners should upgrade to versions beyond 2.7 and disable telnetd where possible.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-3688
Vulnerability Data
telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root" value for the USER environment variable.
- CWE(s)
- KEV Date Added
- 26 January 2026
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V1.2.5
Mitigating Controls (NIST 800-53 r5) AI
Developer testing can discover argument-injection flaws in command-construction code but does not stop their introduction.
Input validation directly stops construction of command strings containing unneutralized delimiters or injected arguments.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly require proper input validation and command construction to prevent argument injection.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing can detect argument injection but does not prevent it at the source.
Secure development lifecycle mandates input validation and command construction practices that directly prevent argument injection.
Application security requirements include explicit rules for safe command-line argument handling and escaping.
Secure architecture principles discourage unsafe command invocation patterns and favor safer APIs.
Secure coding standards explicitly require proper neutralization of command arguments, directly eliminating CWE-88.
Change management can catch unsafe command patterns during reviews but is not a direct mitigation.