CVE-2026-24061

CriticalCVSS 9.8/10Known exploited (CISA KEV)Last modified Sep 30, 2026

Description

telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root" value for the USER environment variable.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-88

Affected software

Vendor	Product	Versions
GNU	Inetutils	>= 1.9.3, <= 2.7

References

https://codeberg.org/inetutils/inetutils/commit/ccba9f748aa8d50a38d7748e2e60362edd6a32ccPatch
https://codeberg.org/inetutils/inetutils/commit/fd702c02497b2f398e739e3119bed0b23dd7aa7bPatch
https://lists.gnu.org/archive/html/bug-inetutils/2026-01/msg00004.htmlMitigation, Vendor Advisory
https://redteam.ae/blog/cve-2026-24061-inetutils-telnetd-root-bypassExploit, Third Party Advisory
https://www.gnu.org/software/inetutils/Product
https://www.openwall.com/lists/oss-security/2026/01/20/2Mailing List
https://www.openwall.com/lists/oss-security/2026/01/20/8Mailing List
https://www.vicarius.io/vsociety/posts/cve-2026-24061-detection-script-remote-authentication-bypass-in-gnu-inetutils-packageThird Party Advisory
https://www.vicarius.io/vsociety/posts/cve-2026-24061-mitigation-script-remote-authentication-bypass-in-gnu-inetutils-packageMitigation, Third Party Advisory
http://www.openwall.com/lists/oss-security/2026/01/22/1Mailing List
https://lists.debian.org/debian-lts-announce/2026/01/msg00025.htmlMailing List, Third Party Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-24061US Government Resource
https://www.labs.greynoise.io/grimoire/2026-01-22-f-around-and-find-out-18-hours-of-unsolicited-houseguests/index.htmlExploit, Third Party Advisory
https://www.openwall.com/lists/oss-security/2026/01/20/2#:~:text=root@...a%3A~%20USER='Mailing List, Third Party Advisory

Timeline

Published: Jan 21, 2026
Last modified: Sep 30, 2026
Added to CISA KEV: Jan 26, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-240627.8The "Privileged Helper" component of the Arturia Software Center (MacOS) does not perform sufficient client code signature validation when a CVE-2026-240638.2When a plugin is installed using the Arturia Software Center (MacOS), it also installs an uninstall.sh bash script in a root owned path. Thi CVE-2026-240647.8Waves Central for macOS versions 13.0.9 through 16.5.5 contain a local privilege escalation vulnerability. A trusted XPC client component in CVE-2026-240658.1Waves Central for macOS versions 13.0.9 through 16.5.5 contain a local privilege escalation vulnerability in the privileged helper service. CVE-2026-240668.4Slate Digital Connect 1.37.0 for macOS installs a privileged helper tool, com.slatedigital.connect.privileged.helper.tool, which exposes the CVE-2026-240678.4Slate Digital Connect 1.37.0 for macOS installs a privileged helper tool, com.slatedigital.connect.privileged.helper.tool, which exposes the CVE-2026-240688.8The VSL privileged helper does utilize NSXPC for IPC. The implementation of the "shouldAcceptNewConnection" function, which is used by the N CVE-2026-240695.4Kiuwan SAST improperly authorizes SSO logins for locally disabled mapped user accounts, allowing disabled users to continue accessing the ap CVE-2026-240708.8During the installation of the Native Access application, a privileged helper `com.native-instruments.NativeAccess.Helper2`, which is used b CVE-2026-240717.8It was found that the XPC service offered by the privileged helper of Native Access uses the PID of the connecting client to verify its cod CVE-2026-240728.8An escalation of privilege bug in various modules in Apache HTTP 2.4.66 and earlier allows local .htaccess authors to read files with the pr CVE-2026-240737.8Memory corruption when processing decode statistics due to insufficient validation of offset against structure size.