CVE-2026-24061
Published: 21 January 2026
Summary
CVE-2026-24061 is a critical-severity Argument Injection (CWE-88) vulnerability in Gnu Inetutils. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 0.1% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 CM-7 (Least Functionality) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2026-24061 is a high-severity vulnerability (CVSS 9.8) in the telnetd daemon of GNU Inetutils versions through 2.7, stemming from CWE-88 (improper neutralization of argument delimiters). It enables remote authentication bypass by setting the USER environment variable to "-f root", allowing attackers to circumvent login credentials without proper validation of the input.
Any unauthenticated remote attacker with network access to the telnetd service can exploit this vulnerability with low complexity and no user interaction required. Successful exploitation grants high-impact privileges, potentially including root-level access, resulting in complete compromise of confidentiality, integrity, and availability (C:H/I:H/A:H) on the affected system.
Mitigation involves applying patches from upstream commits, such as ccba9f748aa8d50a38d7748e2e60362edd6a32cc and fd702c02497b2f398e739e3119bed0b23dd7aa7b on Codeberg, which address the authentication flaw. Advisories on GNU bug-inetutils and oss-security mailing lists detail the issue and fixes, with further details available on the GNU Inetutils project page; security practitioners should upgrade to versions beyond 2.7 and disable telnetd where possible.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-3688
Vulnerability details
telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root" value for the USER environment variable.
- CWE(s)
- KEV Date Added
- 26 January 2026
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability allows unauthenticated remote exploitation of the telnetd daemon via argument injection for authentication bypass, granting root access. This directly maps to T1190 (public-facing service exploit), T1210 (remote service exploitation), and T1068 (privilege escalation via exploit).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly remediates the authentication bypass flaw in telnetd by identifying, reporting, and applying patches from upstream commits.
Requires validation of inputs such as the USER environment variable to neutralize argument delimiters and prevent authentication bypass via CWE-88.
Prohibits or restricts unnecessary insecure services like telnetd to eliminate exposure to this remote authentication bypass vulnerability.