{"id":"gnu-inetutils-telnet-login-bypass-jan-2026","category":"patch","status":"closed","title":"GNU Inetutils Telnet server password bypass CVE-2026-24061 exploited; fixes available","tldr":"Attackers used CVE-2026-24061 to enter vulnerable GNU Inetutils Telnet servers without a password. Disable Telnet where possible; otherwise install Inetutils 2.8 or your operating-system vendor's fixed package and investigate possible compromise.","summary":"CVE-2026-24061 affects the Telnet server in GNU Inetutils versions 1.9.3–2.7. It mishandles information supplied by a connecting client, allowing an attacker to bypass password checks and gain full administrator access. The exposure concerns systems running this server, rather than everyone with a Telnet client installed. GNU disclosed the flaw and source patches on 20 January. GreyNoise observed attacks against its monitoring systems on 21–22 January, and CISA confirmed exploitation by listing the flaw on 26 January. GNU released the fix in Inetutils 2.8 on 29 April; Debian also provides fixes backported to older package versions. Administrators should use their operating-system or appliance maker's security update rather than judging safety from the upstream version number alone. The available reporting does not establish the total number of compromised systems.","action":"Ask whoever manages your business or household's Linux servers and network equipment whether GNU Inetutils telnetd is enabled, and have it disabled where possible. If it is needed, install Inetutils 2.8 or the equipment or operating-system maker's fixed package, restrict network access, and have exposed systems checked for unauthorised access.","product":"GNU Inetutils Telnet server (telnetd)","audience":"work","severity":"critical","patch":"patched","exploited":true,"cves":["CVE-2026-24061"],"tags":["gnu","inetutils","telnet","authentication-bypass","linux","actively-exploited"],"affected":["GNU Inetutils telnetd versions 1.9.3 through 2.7, without a vendor-backported fix"],"fixed":["GNU Inetutils 2.8","Debian 11: inetutils 2:2.0-1+deb11u4","Debian 12: inetutils 2:2.4-2+deb12u2","Debian 13: inetutils 2:2.6-3+deb13u1","Debian unstable: inetutils 2:2.7-2"],"matches":[],"sources":[{"kind":"advisory","title":"GNU InetUtils Security Advisory: remote authentication by-pass in telnetd","url":"https://seclists.org/oss-sec/2026/q1/89","by":"GNU (Simon Josefsson), archived by SecLists","date":"2026-01-20"},{"kind":"post","title":"inetutils-2.8 released with 2 CVE fixes","url":"https://seclists.org/oss-sec/2026/q2/289","by":"GNU release announcement, forwarded by Alan Coopersmith","date":"2026-04-29"},{"kind":"research","title":"-f Around and Find Out: 18 Hours of Unsolicited Telnet Houseguests","url":"https://www.labs.greynoise.io/grimoire/2026-01-22-f-around-and-find-out-18-hours-of-unsolicited-houseguests/index.html","by":"GreyNoise","date":"2026-01-22"},{"kind":"news","title":"Hackers exploit critical telnetd auth bypass flaw to get root","url":"https://www.bleepingcomputer.com/news/security/hackers-exploit-critical-telnetd-auth-bypass-flaw-to-get-root/","by":"BleepingComputer","date":"2026-01-23"},{"kind":"advisory","title":"CVE-2026-24061 — Debian Security Tracker","url":"https://security-tracker.debian.org/tracker/CVE-2026-24061","by":"Debian","date":""},{"kind":"advisory","title":"CISA Known Exploited Vulnerability entry: CVE-2026-24061","url":"https://db.gcve.eu/known-exploited-vulnerabilities-catalog/ce9ee6df-b43d-4c0b-b17f-7704049f6646","by":"GCVE, reproducing CISA's entry","date":"2026-01-26"}],"started":"2026-01-20","closed":"2026-04-29","created":"2026-11-03T22:33:28.834Z","updated":"2026-11-03T22:33:28.834Z","cve_notes":[{"cve":"CVE-2026-24061","name":"Password bypass in GNU Inetutils Telnet server","what":"The GNU Inetutils Telnet server passes client-controlled information to the system login program unsafely, allowing a remote attacker to bypass authentication and obtain full administrator access.","severity":"high","cvss":9.8}],"timeline":[{"at":"2026-04-29","added":"2026-11-03T22:24:44.025Z","kind":"new-fix","text":"GNU released Inetutils 2.8 with the authentication-bypass fix. BleepingComputer had described 2.8 as already available in January, but GNU's release announcement dates the stable release to 29 April.","url":"https://seclists.org/oss-sec/2026/q2/289","by":"GNU release announcement, reproduced on oss-security","patch":"patched"},{"at":"2026-01-26","added":"2026-11-03T22:24:44.025Z","kind":"cisa-added","text":"CISA added CVE-2026-24061 to its Known Exploited Vulnerabilities catalogue, with a 16 February remediation deadline for US federal civilian agencies. Its entry does not establish whether ransomware campaigns used it.","url":"https://db.gcve.eu/known-exploited-vulnerabilities-catalog/ce9ee6df-b43d-4c0b-b17f-7704049f6646","by":"GCVE, reproducing CISA's entry","patch":null},{"at":"2026-01-22","added":"2026-11-03T22:24:44.025Z","kind":"wider-attacks","text":"GreyNoise reported 60 attack sessions from 18 source IP addresses on 21–22 January against its monitoring systems. Some attackers obtained administrator access and attempted to install malware or retain access.","url":"https://www.labs.greynoise.io/grimoire/2026-01-22-f-around-and-find-out-18-hours-of-unsolicited-houseguests/index.html","by":"GreyNoise","patch":null},{"at":"2026-01-20","added":"2026-11-03T22:24:44.025Z","kind":"disclosed","text":"GNU disclosed a password bypass in the Telnet server in Inetutils 1.9.3–2.7 and supplied two source patches. It recommended disabling the server or restricting access while applying the fix.","url":"https://seclists.org/oss-sec/2026/q1/89","by":"GNU (Simon Josefsson), archived by SecLists","patch":"partial"}],"url":"https://hard.fyi/live/gnu-inetutils-telnet-login-bypass-jan-2026/","json":"https://hard.fyi/api/live?id=gnu-inetutils-telnet-login-bypass-jan-2026"}