NewsCompaniesFlawsGuides
Get the app
CriticalFixedBeing used in attacksClosedUpdated

GNU Inetutils Telnet server password bypass CVE-2026-24061 exploited; fixes available

Attackers used CVE-2026-24061 to enter vulnerable GNU Inetutils Telnet servers without a password. Disable Telnet where possible; otherwise install Inetutils 2.8 or your operating-system vendor's fixed package and investigate possible compromise.

What to do

Ask whoever manages your business or household's Linux servers and network equipment whether GNU Inetutils telnetd is enabled, and have it disabled where possible. If it is needed, install Inetutils 2.8 or the equipment or operating-system maker's fixed package, restrict network access, and have exposed systems checked for unauthorised access.

What’s happening

CVE-2026-24061 affects the Telnet server in GNU Inetutils versions 1.9.3–2.7. It mishandles information supplied by a connecting client, allowing an attacker to bypass password checks and gain full administrator access. The exposure concerns systems running this server, rather than everyone with a Telnet client installed. GNU disclosed the flaw and source patches on 20 January. GreyNoise observed attacks against its monitoring systems on 21–22 January, and CISA confirmed exploitation by listing the flaw on 26 January. GNU released the fix in Inetutils 2.8 on 29 April; Debian also provides fixes backported to older package versions. Administrators should use their operating-system or appliance maker's security update rather than judging safety from the upstream version number alone. The available reporting does not establish the total number of compromised systems.

What
Flaw
Affects
GNU Inetutils Telnet server (telnetd)
Affected
GNU Inetutils telnetd versions 1.9.3 through 2.7, without a vendor-backported fix
Fixed in
GNU Inetutils 2.8
Debian 11: inetutils 2:2.0-1+deb11u4
Debian 12: inetutils 2:2.4-2+deb12u2
Debian 13: inetutils 2:2.6-3+deb13u1
Debian unstable: inetutils 2:2.7-2
CVE
CVE-2026-24061
Since
20 Jan 2026
Closed
29 Apr 2026

Timeline

  1. New fixFixed

    GNU released Inetutils 2.8 with the authentication-bypass fix. BleepingComputer had described 2.8 as already available in January, but GNU's release announcement dates the stable release to 29 April.

  2. CISA added

    CISA added CVE-2026-24061 to its Known Exploited Vulnerabilities catalogue, with a 16 February remediation deadline for US federal civilian agencies. Its entry does not establish whether ransomware campaigns used it.

  3. Wider attacks

    GreyNoise reported 60 attack sessions from 18 source IP addresses on 21–22 January against its monitoring systems. Some attackers obtained administrator access and attempted to install malware or retain access.

  4. Made publicPartly fixed

    GNU disclosed a password bypass in the Telnet server in Inetutils 1.9.3–2.7 and supplied two source patches. It recommended disabling the server or restricting access while applying the fix.

Sources

  1. GNU InetUtils Security Advisory: remote authentication by-pass in telnetdGNU (Simon Josefsson), archived by SecLists · 20 Jan 2026
  2. inetutils-2.8 released with 2 CVE fixesGNU release announcement, forwarded by Alan Coopersmith · 29 Apr 2026
  3. -f Around and Find Out: 18 Hours of Unsolicited Telnet HouseguestsGreyNoise · 22 Jan 2026
  4. Hackers exploit critical telnetd auth bypass flaw to get rootBleepingComputer · 23 Jan 2026
  5. CVE-2026-24061 — Debian Security TrackerDebian
  6. CISA Known Exploited Vulnerability entry: CVE-2026-24061GCVE, reproducing CISA's entry · 26 Jan 2026
HARD Live follows this until it’s over: each change is added to the timeline with its source. Everything live · Everything from January 2026 · JSON · RSS