CVE-2026-24061: GNU InetUtils Argument Injection Vulnerability

GNU InetUtils is a collection of common network utilities for Unix-like systems. This vulnerability is an argument injection flaw in its telnetd component that can let a remote attacker bypass authentication by supplying a crafted value to the USER environment variable. The issue matters because telnetd often runs with elevated privileges and may be reachable on systems that still expose the service.

How it works

CWE-88 covers argument injection, where untrusted input is concatenated into a command line or passed to another process without proper separation or quoting. In this case the telnetd daemon accepts a USER environment variable supplied during the telnet session negotiation. An attacker can include a value that the daemon later treats as an additional command-line argument, potentially altering authentication behavior. Specific mechanics, affected code paths, and required preconditions must be confirmed against the vendor advisory.

Am I affected? How to find it in your systems

GNU InetUtils telnetd is typically installed on Linux or BSD systems that still provide legacy remote-login services. Begin by inventorying hosts that have the inetutils or telnetd package installed and are listening on TCP port 23. Check running processes and package managers for any version of GNU InetUtils that includes telnetd. Review service configurations to determine whether telnetd is enabled and which environment variables it accepts from clients. Look in authentication logs for telnet sessions that record unusual USER values or repeated connection attempts from unexpected sources. Exact version checks and configuration flags must be confirmed against the vendor advisory.

How to remediate

Apply the vendor-supplied update for GNU InetUtils as the primary remediation. After patching, disable the telnet service entirely if it is not required, or restrict it to localhost-only listening. For the broader argument-injection class, ensure that any network daemons that accept environment variables from clients perform strict validation or sanitization before those values are used in subsequent calls. Follow applicable CISA BOD 22-01 guidance for cloud-hosted instances.

If you can't patch immediately

Place affected systems behind network segmentation that blocks inbound telnet traffic from untrusted networks. Disable the telnetd service through the system service manager until a patch can be applied. If a web application firewall or similar proxy sits in front of the host, configure rules to drop or sanitize telnet option negotiations that carry environment-variable data. Increase monitoring of authentication logs and process-creation events on hosts running telnetd to detect anomalous activity while the service remains reachable.

If your data may have been exposed

Actively exploited vulnerabilities can lead to breaches. You can run a free exposure scan of your email addresses to check known breach data.