CVE-2026-24061
CISA KEV
ACT NOW
Priority: 0.00
BB Relevance:
10/100
Published: N/A
Modified: N/A
First seen: 2026-10-29
Status: pending_score
Description
GNU InetUtils contains an argument injection vulnerability in telnetd that could allow for remote authentication bypass via a "-f root" value for the USER environment variable.
CISA Known Exploited Vulnerability
Vendor / Product
GNU — InetUtils
Date Added
2026-01-26
Remediation Due
2026-02-16
This vulnerability could affect an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: https://cgit.git.savannah.gnu.org/cgit/inetutils.git ; https://codeberg.org/inetutils/inetutils/commit/ccba9f748aa8d50a38d7748e2e60362edd6a32cc; https://codeberg.org/inetutils/inetutils/commit/fd702c02497b2f398e739e3119bed0b23dd7aa7b ; https://nvd.nist.gov/vuln/detail/CVE-2026-24061
Weakness Classification (1)
Affected Software (2)
| Vendor | Product | Version |
|---|---|---|
| debian | debian_linux | 11.0 |
| gnu | inetutils | 1.9.3 – 2.7 |
References & Advisories (14)
US Government Resource
Third Party Advisory
Product
Patch
Patch
Mitigation
Vendor Advisory
Mitigation
Third Party Advisory
Mailing List
Third Party Advisory
Mailing List
Third Party Advisory
Mailing List
Mailing List
Mailing List
Exploit
Third Party Advisory
Exploit
Third Party Advisory