GNU Inetutils Telnetd Authentication Bypass (CVE-2026-24061)

hackviser

Task: GNU Inetutils telnetd (< 2.4) with CVE-2026-24061 argument injection via unsanitized USER environment variable. Solution: Inject '-f root' as USER via telnet ENVIRON option to force /bin/login to authenticate as root without a password.

argument_injection authentication_bypass bin_login cve_2026_24061 environment_variable_injection gnu_inetutils telnetd telnet_environ

argument_injection_via_user_environlogin_force_flag_bypasstelnet_environ_variable_manipulation

$ ls tags/ techniques/

argument_injection authentication_bypass bin_login cve_2026_24061 environment_variable_injection gnu_inetutils telnetd telnet_environ

argument_injection_via_user_environlogin_force_flag_bypasstelnet_environ_variable_manipulation

$ cat /etc/rate-limit

Rate limit reached (20 reads/hour per IP). Showing preview only — full content returns at the next hour roll-over.

GNU Inetutils Telnetd Authentication Bypass (CVE-2026-24061) — Hackviser

Description

GNU Inetutils telnetd is a widely used daemon that provides remote command-line access. This laboratory contains the CVE-2026-24061 vulnerability, affecting GNU Inetutils versions prior to 2.4. This is a critical Argument Injection flaw. The daemon improperly passes the USER environment variable (supplied by the client) to the /bin/login binary without sanitization.

English summary: A telnetd service running GNU Inetutils < 2.4 is vulnerable to CVE-2026-24061. The daemon passes the client-supplied USER environment variable directly to /bin/login as a command-line argument without any sanitization. By injecting -f root as the USER value, an attacker can instruct /bin/login to force authentication as root, completely bypassing the password check. The goal is to exploit this to gain root access and retrieve the flag.

Analysis

Target Reconnaissance

The target at 172.20.16.130 had port 23 (telnet) open, running GNU Inetutils telnetd on Debian (kernel 5.10.0-33-amd64).

Vulnerability Details

CVE-2026-24061 is a critical argument injection vulnerability in GNU Inetutils telnetd versions prior to 2.4.

The vulnerability chain:

The telnet protocol supports the ENVIRON option (RFC 1572), which allows the client to send environment variables to the server during the connection handshake.
The telnetd daemon receives the USER environment variable from the client.
telnetd constructs the login command by appending the USER variable value as arguments to /bin/login — without any sanitization or validation.
If the USER variable contains -f root, the resulting command becomes /bin/login -f root.
The -f flag of /bin/login is a "force" flag that bypasses password authentication for the specified user.

This means any remote attacker can gain root access without knowing any credentials.

Key Telnet Client Flags

...