## https://sploitus.com/exploit?id=161BBA2D-365A-5283-9A03-9BEBFCC93AED
# CVE-2026-24061 — GNU Inetutils Telnetd Authentication Bypass
CVE: CVE-2026-24061
Severity: Critical
CVSS: 9.8 (Critical)
CWE: CWE-88 — Improper Neutralization of Argument Delimiters in a Command
Affected Component: GNU Inetutils telnetd
Affected Versions: 1.9.3 through 2.7
## Overview
CVE-2026-24061 is a critical authentication bypass vulnerability in the Telnet server implementation provided by GNU Inetutils.
The vulnerability originates from insufficient validation of the client-controlled USER environment variable when Telnet automatic login is enabled. A malicious value can be interpreted as an option to the system login program rather than as a username.
Under vulnerable configurations, an unauthenticated remote attacker may abuse this behavior to invoke login with the -f option and bypass authentication, potentially obtaining a shell with the privileges of the requested account.
When the affected Telnet service is running with root privileges, successful exploitation can result in unauthenticated remote root access.
## Technical Description
The vulnerable execution flow can be summarized as:
Telnet Client
│
│ USER=-f root
▼
telnetd
│
│ constructs login arguments
▼
login -f root
│
│ authentication bypass
▼
root shell