# CVE-2026-24061: telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root" value for the USER environment variable.

Source: https://junglewise.ai/threats/cve-2026-24061-gnu-inetutils-argument-injection-in-telnetd  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-01-21. Updated: 2026-05-15  
License: CC BY 4.0 with a link back

CVE-2026-24061 · Severity: critical · CVSS 9.8 · Exploited in the wild · Published 2026-01-21

GNU InetUtils is a collection of common network programs, including a telnet server used for remote terminal access. A critical vulnerability allows an attacker to bypass the login process and gain full administrative access to the system without a password. This flaw is actively being exploited in the wild and could lead to complete system takeover and data theft.

Technologies: [Debian Linux](https://junglewise.ai/threats/technologies/debian). Vendors: [Debian](https://junglewise.ai/threats/vendors/debian), [Gnu](https://junglewise.ai/threats/vendors/gnu).

## Quick answers

**Is CVE-2026-24061 exploited in the wild?** Yes. CVE-2026-24061 is known to be exploited in the wild, first recorded on 26 January 2026. Treat it as urgent.

**How severe is CVE-2026-24061?** Critical severity, with a CVSS score of 9.8, published 21 January 2026.

**Which products and versions are affected?** GNU InetUtils 1.9.3 through 2.7.

**Is there a fix for CVE-2026-24061?** A patch was published on 2026-01-30: Patches identified in GNU InetUtils source repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-24061 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-24061?** Check whether you run Debian Linux or GNU inetutils. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An argument injection vulnerability (CWE-88) exists in the telnetd daemon of GNU InetUtils versions 1.9.3 through 2.7. The vulnerability is rooted in the improper neutralization of argument delimiters when processing the USER environment variable passed during the Telnet protocol negotiation. By providing a specially crafted value such as '-f root', an unauthenticated remote attacker can inject arguments into the underlying login process. This allows the attacker to bypass standard authentication mechanisms and gain a root shell. Patches have been released in the project's source repository, and the vulnerability is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

## Affected products

- GNU InetUtils 1.9.3 through 2.7

## Timeline

- 2026-01-20: disclosed: Initial disclosure on oss-security mailing list
- 2026-01-26: advisory: NVD publication and CISA KEV addition
- 2026-01-26: exploited: Confirmed active exploitation in the wild per CISA KEV
- 2026-01-30: patched: Patches identified in GNU InetUtils source repository

## Related threats

- [libpng use-after-free in chunk setter functions](https://junglewise.ai/threats/cve-2026-34757-libpng-use-after-free-in-chunk-setter-functions)
- [firewalld incorrect authorization in D-Bus setters](https://junglewise.ai/threats/cve-2026-4948-firewalld-incorrect-authorization-in-d-bus-setters)
- [libtiff signed integer overflow in putcontig8bitYCbCr44tile](https://junglewise.ai/threats/cve-2026-4775-libtiff-signed-integer-overflow-in-putcontig8bitycbcr44tile)
- [An incomplete fix for allows an out-of-bounds read in gst_wavparse_adtl_chunk() function. The patch added a size validation c](https://junglewise.ai/threats/cve-2026-1940-an-incomplete-fix-for-allows-an-out-of-bounds-read-in-gst-wavparse)
- [OpenSSH GSSAPI uninitialized variable use in Linux distributions](https://junglewise.ai/threats/cve-2026-3497-openssh-gssapi-uninitialized-variable-use-in-linux-distributions)