CVE-2026-28372: 
NixOS vulnerability analysis and mitigation

CVE-2026-28372 is a local privilege escalation vulnerability in telnetd as shipped with GNU inetutils through version 2.7. It arises from the interaction between telnetd's insufficient environment variable sanitization and the systemd service credentials support introduced in util-linux 2.40's login(1) implementation. An unprivileged local user can exploit this by controlling the CREDENTIALS_DIRECTORY environment variable and creating a login.noauth file, bypassing authentication and escalating to root. The vulnerability was publicly disclosed on February 27, 2026, with the CVE assigned by the Debian Security Team (Salvatore Bonaccorso). It carries a CVSS v3.1 base score of 7.8 (High) per NVD, and 7.4 (High) per MITRE (NVD, oss-security).

The root cause is classified as CWE-829 (Inclusion of Functionality from Untrusted Control Sphere), stemming from telnetd's blacklist-based approach to filtering environment variables passed to /bin/login. Because telnetd executes /bin/login in a root-to-root context, the kernel sets AT_SECURE to 0 in the process's auxiliary vector, meaning the dynamic linker does not enter secure-execution mode and does not discard attacker-controlled environment variables. The primary attack vector (reported by Ron Ben Yizhak) involves a client injecting the CREDENTIALS_DIRECTORY environment variable via the telnet protocol; when util-linux 2.40's login(1) checks this directory for systemd service credentials, a locally created login.noauth file causes it to skip authentication entirely. A broader related vector (reported by Justin Swartz) involves injecting GNU gettext and glibc variables such as GCONV_PATH, OUTPUT_CHARSET, and LANGUAGE to force iconv_open() to load an attacker-controlled shared object, achieving arbitrary code execution as root without any authentication (oss-security Feb 24, GNU bug-inetutils, NVD).

Successful exploitation grants a local unprivileged attacker complete root-level privilege escalation on the affected system, resulting in high impact to confidentiality (full access to all data), integrity (ability to modify any file or configuration), and availability (ability to disrupt or destroy system services). The attacker can create SUID/SGID binaries, install persistent backdoors, or pivot to other systems on the network. Systems running both GNU inetutils ≤ 2.7 and util-linux ≥ 2.40 with telnetd exposed are at risk (Feedly, oss-security Feb 24).

Multiple proof-of-concept exploits are publicly available: the original vulnerability report on the GNU bug-inetutils mailing list, a GitHub PoC repository (kalibb/CVE-2026-28372-GNU-inetutils-telnetd-Privilege-Escalation-main), and a second PoC (Rohitberiwala/CVE-2026-28372). The EPSS score is approximately 0.012% (very low automated exploitation probability), and there is no evidence of active in-the-wild exploitation or CISA KEV catalog listing as of the time of reporting. No specific threat actor attribution has been made (GNU bug-inetutils, GitHub PoC, Feedly).

1. Reconnaissance: Identify systems running GNU inetutils ≤ 2.7 with telnetd active and util-linux ≥ 2.40 installed. Confirm telnet service is listening (default port 23).
2. Obtain local unprivileged access: The exploit requires a local account or a means to write files to the target filesystem (e.g., via a shared directory or another vulnerability).
3. Create login.noauth file (CREDENTIALS_DIRECTORY vector): As the unprivileged user, create a directory to serve as a fake credentials directory and place a login.noauth file inside it (e.g., mkdir -p /home/attacker/.creds && touch /home/attacker/.creds/login.noauth).
4. Inject CREDENTIALS_DIRECTORY via telnet: Use the telnet client's environ command to define and export CREDENTIALS_DIRECTORY pointing to the attacker-controlled directory before opening the connection:

   telnet> environ define CREDENTIALS_DIRECTORY /home/attacker/.creds
   telnet> environ export CREDENTIALS_DIRECTORY
   telnet> open 127.0.0.1

5. Bypass authentication: util-linux 2.40's login(1) detects the login.noauth file in CREDENTIALS_DIRECTORY and skips password authentication, granting a root shell.
6. Alternative — dynamic linker escape (GCONV_PATH vector): Prepare a malicious gconv-modules file and shared object in an attacker-controlled directory. Inject GCONV_PATH, LANGUAGE, and OUTPUT_CHARSET via telnet environ to force iconv_open() to load the malicious shared object when /bin/login prints a localized prompt, executing arbitrary code as root (e.g., creating a SUID copy of /bin/sh) without any authentication (oss-security Feb 24, GNU bug-inetutils).

• Network: Telnet connections (TCP port 23) with environment variable negotiation options (ENVIRON or NEW-ENVIRON telnet options) carrying CREDENTIALS_DIRECTORY, GCONV_PATH, LANGUAGE, or OUTPUT_CHARSET in the option data; unexpected outbound connections from the telnetd host after a telnet session.
• File System: Presence of a login.noauth file in any user-writable directory; attacker-created directories containing gconv-modules files and .so shared objects in non-standard locations (e.g., under home directories); new SUID/SGID binaries (e.g., copies of /bin/sh) in user home directories or /tmp.
• Logs: /var/log/auth.log or syslog entries showing login sessions that completed without password authentication for non-root users; telnetd log entries showing environment variable negotiation with suspicious variable names.
• Process: Unexpected child processes of telnetd or login (e.g., /bin/bash, id, cp) running as root; processes with euid=0 but uid of an unprivileged user spawned from a telnet session (oss-security Feb 24).

The primary remediation is to upgrade GNU inetutils to a version beyond 2.7 once a patched upstream release is available. A fix has been committed to the Debian inetutils packaging repository (commit 3953943d8296310485f98963883a798545ab9a6c), and Debian LTS users should apply the update announced in debian-lts-announce (DLA-4527-1). As an immediate workaround, disable telnetd entirely and replace it with SSH, which is the strongly recommended long-term approach. If telnetd must remain active, restrict access via firewall rules to trusted hosts only, and monitor for suspicious environment variable manipulation. The proper architectural fix requires telnetd to adopt a strict whitelist approach (similar to OpenSSH's AcceptEnv) rather than a blacklist for environment variables passed to /bin/login (Debian patch, Debian LTS, oss-security Feb 24).

The vulnerability was discussed extensively on the oss-security mailing list, with notable contributions from researcher Justin Swartz (Rising Edge), who identified the broader dynamic linker escape vector beyond the original CREDENTIALS_DIRECTORY issue reported by Ron Ben Yizhak. Solar Designer (Openwall) raised questions about CVE scoping — whether one or two CVEs should cover the related attack vectors — reflecting community debate about proper CVE assignment practices. Guillem Jover (Debian inetutils maintainer) confirmed plans to patch the root cause rather than individual vectors. The Yocto Project security list also tracked the issue for embedded Linux distributions. Community sentiment on Bluesky (infosec.skyfleet.blue) noted the irony of a 27-year-old vulnerability class (CVE-1999-0073) resurfacing in modern systems (oss-security Feb 24, oss-security Feb 27, oss-security Mar 6).