CVE-2026-24061: 
NixOS vulnerability analysis and mitigation

CVE-2026-24061 is a critical argument injection vulnerability in the telnetd daemon of GNU Inetutils that allows unauthenticated remote attackers to bypass authentication and gain root access. The flaw affects GNU Inetutils versions 1.9.3 through 2.7 (introduced in a commit on 2015-03-19) and was publicly disclosed on January 20, 2026, with a CVE assigned on January 21, 2026. Debian Linux 11.0 is also listed as a confirmed affected platform. It carries a CVSS v3.1 base score of 9.8 (Critical) (Openwall Advisory, NVD).

The root cause is improper neutralization of argument delimiters in a command (CWE-88). The telnetd daemon passes the client-supplied USER environment variable directly to /usr/bin/login without sanitization, using the template login -p -h %h %?u{-f %u}{%U}. When a client sets USER='-f root' and connects with the -a (autologin) flag, the resulting invocation becomes login -p -h <host> -f root, causing login(1) to bypass authentication entirely and log the attacker in as root. The bug was introduced in a 2015 commit and was actually patched in Debian's packaging in 2019 but inadvertently reintroduced when a subsequent CVE-2020-10188 fix was applied. Two upstream patches address the issue by sanitizing all variables before expansion (Openwall Advisory, Codeberg Patch 1, Codeberg Patch 2).

Successful exploitation grants an unauthenticated remote attacker immediate root-level access to the affected system over the network, with no user interaction required. This results in complete compromise of confidentiality, integrity, and availability — attackers can read all data, modify or destroy files, install backdoors, and use the compromised host as a pivot point for lateral movement within the network. Approximately 800,000 telnet servers were identified as exposed to this attack at the time of disclosure (BleepingComputer, Feedly).

CVE-2026-24061 was added to CISA's Known Exploited Vulnerabilities (KEV) catalog on January 26, 2026, with a remediation due date of February 16, 2026, confirming active in-the-wild exploitation (CISA KEV). Multiple public proof-of-concept exploits were released rapidly after disclosure, including repositories by SafeBreach Labs and others on GitHub, and a Metasploit module (exploit/linux/telnet/gnu_inetutils_auth_bypass) was merged into the framework by February 13, 2026 (Rapid7 Metasploit, GreyNoise). The EPSS score is approximately 0.34 (34%), reflecting high exploitation probability. GreyNoise observed active scanning and exploitation beginning within 18 hours of public disclosure.

1. Reconnaissance: Use Shodan, Censys, or Masscan to identify internet-facing hosts with TCP port 23 (Telnet) open running GNU Inetutils telnetd versions 1.9.3–2.7. Nuclei templates are publicly available for automated detection.
2. Set malicious USER environment variable: On the attacker's machine, set the environment variable USER='-f root' before initiating the telnet connection.
3. Initiate autologin connection: Connect to the target using the telnet client with the -a (autologin) flag: USER='-f root' telnet -a <target_ip>. This causes the telnet client to transmit the crafted USER value to the server.
4. Trigger argument injection: The vulnerable telnetd daemon receives the USER value and constructs the login command as login -p -h <remote_host> -f root, where -f root instructs login(1) to skip authentication for the root account.
5. Achieve root shell: The attacker receives an interactive root shell on the target system without providing any credentials. From here, they can install persistence mechanisms, exfiltrate data, or pivot to other internal systems (Openwall Advisory, GreyNoise, Horizon3).

• Network: Inbound TCP connections to port 23 from unexpected or external IP addresses; telnet sessions where the USER environment variable contains the string -f root or similar argument-injection patterns; sudden spikes in port 23 traffic.
• Logs: System authentication logs (/var/log/auth.log, /var/log/secure) showing root login via telnet without a preceding password prompt; telnetd process logs showing login invoked with -f root argument; entries like ROOT LOGIN on ttyXX from unexpected sources.
• Process: Unexpected child processes spawned by telnetd or login running as root (e.g., /bin/bash, sh, nc, curl, wget); new cron jobs, SSH authorized keys, or SUID binaries created by root after a telnet session.
• File System: New files in /root/, /tmp/, or /var/tmp/ created around the time of suspicious telnet connections; modifications to /etc/passwd, /etc/shadow, or /etc/sudoers; web shells or reverse shell scripts dropped on the system.
• Registry/Persistence: New systemd services, init scripts, or cron entries added by the root account following a telnet session (GreyNoise, Horizon3).

The primary remediation is to upgrade GNU Inetutils to a version after 2.7 that incorporates the two upstream patches (commits ccba9f74 and fd702c02 on Codeberg). Debian LTS users should apply the security update published in debian-lts-announce/2026/01/msg00025.html; Gentoo and Ubuntu updates are also available. As an immediate workaround, disable or stop the telnetd service entirely — telnet is a deprecated protocol and should be replaced with SSH. If telnetd must remain operational, restrict access to port 23 using firewall rules to trusted IP ranges only. Organizations should also audit systems for signs of prior exploitation given the rapid weaponization timeline (GNU Advisory, CISA KEV, Debian LTS).

The vulnerability generated significant community attention, with The Register describing it as an "ancient telnet bug that happily hands out root to attackers" and CSO Online calling it a "trivial telnet authentication bypass." Security researchers noted the irony that the bug was introduced in 2015, patched in Debian's packaging in 2019, and then accidentally reintroduced — making it an 11-year-old flaw by the time of disclosure (The Register, Openwall). GreyNoise reported observing active exploitation within 18 hours of public disclosure, and SC World warned of widespread compromise likelihood following PoC release. The H-ISAC issued a TLP:WHITE threat bulletin on January 27, 2026, highlighting active exploitation of the 11-year-old flaw (H-ISAC, SC World). Synology also issued a security advisory (SA_26_01) for affected NAS products, and Moxa published a response advisory for affected industrial devices.