CVE-2026-28372

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

telnetd in GNU inetutils through 2.7 allows privilege escalation that can be exploited by abusing systemd service credentials support added to the login(1) implementation of util-linux in release 2.40. This is related to client control over the CREDENTIALS_DIRECTORY environment variable, and requires an unprivileged local user to create a login.noauth file.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-829

Affected software

Vendor	Product	Versions
GNU	inetutils	<= 2.7

References

https://git.hadrons.org/cgit/debian/pkgs/inetutils.git/commit/?id=3953943d8296310485f98963883a798545ab9a6cPatch
https://lists.gnu.org/archive/html/bug-inetutils/2026-02/msg00000.htmlExploit, Mailing List, Third Party Advisory
https://lists.gnu.org/archive/html/bug-inetutils/2026-02/msg00012.htmlMailing List, Third Party Advisory
https://www.openwall.com/lists/oss-security/2026/02/24/1Mailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2026/02/27/3Mailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2026/03/06/2
http://www.openwall.com/lists/oss-security/2026/03/06/3
http://www.openwall.com/lists/oss-security/2026/03/07/1
http://www.openwall.com/lists/oss-security/2026/03/07/2

Timeline

Published: Feb 27, 2026
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2026

CVE-2026-283739.6The Stackfield Desktop App before 1.10.2 for macOS and Windows contains a path traversal vulnerability in certain decryption functionality w CVE-2026-283744.3Editors could delete any annotation, even those they do not have read access to. The editor user cannot create or read the annotations.CVE-2026-283756.5A testdata data-source can be used to trigger out-of-memory crashes in Grafana.CVE-2026-283766.5The Grafana Live push endpoint can be exploited to cause unbounded memory allocation by sending a large or streaming request body, potential CVE-2026-283777.5A vulnerability in Grafana Tempo exposes the S3 SSE-C encryption key in plaintext through the /status/config endpoint, potentially allowing CVE-2026-283782.7The public dashboard deletion endpoint does not enforce organization isolation, allowing an Org Admin in one organization to delete public d CVE-2026-283796.5A race condition in Grafana Live allows authenticated users with Viewer role to trigger a server crash by sending concurrent requests that c CVE-2026-28384.4The Whole Enquiry Cart for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘woowhole_success_msg’ para CVE-2026-283806.5Any Editor could delete any snapshot, even if they have no access to read or write them.CVE-2026-283818.1The Snowflake datasource allows for GET/PUT commands, which can allow any user with access to run queries against the data source to read/wr CVE-2026-283836.5A request to the Grafana plugin resources endpoint can cause unbounded memory allocation by reading the entire request body into memory. An CVE-2026-283849.9An improper sanitization of the compression_algorithm parameter in Canonical LXD allows an authenticated, unprivileged user to execute comma