CVE-2026-28372
Published: 27 February 2026
Summary
CVE-2026-28372 is a high-severity Inclusion of Functionality from Untrusted Control Sphere (CWE-829) vulnerability in Gnu Inetutils. Its CVSS base score is 7.4 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 0.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Threat & Defense at a Glance
Threat & Defense Details
Likely Mitigating ControlsAI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Limiting P2P file sharing technology reduces inclusion of functionality or resources from untrusted external control spheres.
Enforcing installation policies prevents users from including functionality obtained from untrusted control spheres.
The inventory process requires identifying and recording the origin of all components, making inclusion of functionality from untrusted control spheres easier to detect during reviews.
Requiring approval and monitoring of maintenance tools prevents inclusion and execution of functionality obtained from untrusted sources.
Unowned portable devices represent untrusted control spheres; the prohibition prevents inclusion of functionality or data from such sources.
Strategy mandates assessment of third-party components and suppliers, directly reducing inclusion of functionality from untrusted control spheres.
Procedures can mandate supply-chain vetting and restrictions on functionality obtained from untrusted third-party or external control spheres.
Requires use of trusted sources and provenance tracking, tangibly limiting inclusion of functionality from untrusted control spheres.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct local privilege escalation via env var abuse and file creation in login/telnetd maps to Exploitation for Privilege Escalation.
NVD Description
telnetd in GNU inetutils through 2.7 allows privilege escalation that can be exploited by abusing systemd service credentials support added to the login(1) implementation of util-linux in release 2.40. This is related to client control over the CREDENTIALS_DIRECTORY environment variable,…
more
and requires an unprivileged local user to create a login.noauth file.
Deeper analysisAI
CVE-2026-28372, published on 2026-02-27, is a privilege escalation vulnerability in telnetd within GNU inetutils through version 2.7. It arises from the abuse of systemd service credentials support added to the login(1) implementation in util-linux release 2.40, specifically due to client control over the CREDENTIALS_DIRECTORY environment variable. Exploitation requires an unprivileged local user to create a login.noauth file. The vulnerability carries a CVSS v3.1 base score of 7.4 (AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) and is associated with CWE-829 (Inclusion of Functionality from Untrusted Control Sphere).
An unprivileged local attacker can exploit this vulnerability by creating a login.noauth file and leveraging control over the CREDENTIALS_DIRECTORY environment variable during telnetd interactions with login(1). Successful exploitation results in privilege escalation, granting high-impact confidentiality, integrity, and availability effects despite the high attack complexity.
Advisories and discussions on GNU inetutils bug lists, oss-security mailing lists, and a Debian inetutils package commit provide details on the issue and mitigations. The referenced commit at https://git.hadrons.org/cgit/debian/pkgs/inetutils.git/commit/?id=3953943d8296310485f98963883a798545ab9a6c appears to address the vulnerability, while threads at https://lists.gnu.org/archive/html/bug-inetutils/2026-02/msg00000.html, https://lists.gnu.org/archive/html/bug-inetutils/2026-02/msg00012.html, https://www.openwall.com/lists/oss-security/2026/02/24/1, and http://www.openwall.com/lists/oss-security/2026/02/27/3 outline the root cause and recommended fixes.
Details
- CWE(s)