A vulnerability discovered in the telnet daemon (telnetd) included in the GNU InetUtils package has been present on production systems for almost 11 years.
CVE-2026-24061 received a severity rating of 9.8 (Critical) for all versions of GNU InetUtils from 1.9.3 to 2.7. The vulnerability enables a remote attacker to log into a system as root without providing a password.
A core issue associated with applying telnet-client environment variables to the login process through telnetd is that telnetd creates the /usr/bin/login process as root when it establishes a connection with the client and blindly forwards the value of the client's USER environment variable without validating it.
This opportunity for attack provides for:
1. Setting -f root in the USER environment variable.
2. Using telnet with the -a or --login command line options to ask the telnetd server to use that value.
Because the login(1) program treats -f root as a flag to skip authentication, the attacker is immediately logged in as root, completely bypassing normal security checks.
In short:
No password. No prompts. Full root access.
Why This Stayed Hidden for So Long
For such a lengthy period of time, this vulnerability remained undetected due to the fact that there was no obvious way for users to detect these flaws prior to the release of the code. GNU contributor Simon Josefsson explained that the code containing this vulnerability was introduced in a single commit on 19th March 2015 and included in the 1.9.3 version of the software shortly thereafter, but the vulnerability itself went unnoticed until January 2026, when security researcher Kyu Neushwaistein (Carlos Cortes Alvarez) reported it.
This is a textbook example of how legacy services especially ones many assume are “already insecure” like Telnet can still hide catastrophic bugs.
Active Exploitation Already Seen
Threat intelligence data from GreyNoise shows that exploitation attempts are already happening:
1. 21 unique IP addresses observed in the last 24 hours
2. Sources include Hong Kong, the U.S., Japan, the Netherlands, China, Germany, Singapore, and Thailand
3. All observed IPs have been flagged as malicious
This is no longer a theoretical risk.
Immediate recommended actions for securing your use of Telnet:
1. Patch GNU InetUtils as soon as possible.
2. Limit access to Telnet's ports to only those clients you know and trust.
If you are unable to implement a patch immediately, you may be able to temporarily work around the vulnerability in one of two ways:
1. Disable telnetd completely.
2. Modify your InetUtils installation to create a custom login(1) binary that does not support the -f flag.
If Telnet remains accessible on your network, this vulnerability effectively converts it to an unrestricted root shell.
Why This Matters
Telnet may be old, but it still exists in:
1. Embedded systems
2. Legacy Linux environments
3. Lab, OT, and industrial networks
This vulnerability shows that “legacy” does not mean harmless and that forgotten services can become the easiest way in.
Source: The Hacker News
