CVE-2026-32772: 
NixOS vulnerability analysis and mitigation

CVE-2026-32772 is an environment variable disclosure vulnerability in the telnet client included with GNU inetutils through version 2.7. A malicious or compromised telnet server can request arbitrary client environment variables using the Telnet NEW_ENVIRON option with the SEND USERVAR command, and the client will respond with the variable's value unconditionally — even if the variable has not been explicitly exported. The vulnerability was publicly disclosed on March 13, 2026, via the oss-security mailing list, and assigned a CVSS v3.1 base score of 4.7 (Medium) (Feedly, oss-security).

The root cause is classified as CWE-669 (Incorrect Resource Transfer Between Spheres): the GNU inetutils telnet client improperly transfers client-side environment data to the server sphere without enforcing export restrictions (Feedly). The Telnet protocol's NEW_ENVIRON option (RFC 1572) allows servers to request environment variables from clients; the vulnerable client responds to NEW_ENVIRON SEND USERVAR <VARNAME> by returning the value of any named variable, regardless of whether it has been exported to the environment. This is a regression related to CVE-2005-0488, which addressed a similar issue in older telnet clients. The attack requires no authentication and only requires that the user connect to a malicious server; it may also be triggered via telnet:// URI scheme handling in terminal-based browsers such as Lynx or Elinks, which inherit the browser's environment and pass the URI directly to the system telnet binary. A working proof-of-concept (envscraper.c) was published alongside the disclosure (oss-security).

A malicious telnet server operator can silently read any environment variable from a connecting client, including sensitive values such as API tokens, passwords, session cookies, AWS_SECRET_ACCESS_KEY, GITHUB_TOKEN, or other credentials stored in the shell environment. The impact is limited to confidentiality (no integrity or availability impact), but credential theft could enable lateral movement, account takeover, or access to cloud infrastructure. Debian-derived distributions (including Ubuntu, Devuan, and Termux) are particularly at risk because Debian switched from netkit-telnet to inetutils telnet during the Debian 12 (Bookworm) cycle, reintroducing this vulnerability to default installations (oss-security, Feedly).

1. Set up a malicious telnet server: Compile and run the published envscraper.c proof-of-concept on a server listening on a chosen port (default: 127.0.0.1:23232, adjustable). The server waits for an incoming telnet connection.
2. Lure the victim: Trick the target user into connecting to the malicious server — either by providing a direct telnet <attacker-ip> <port> command, or by embedding a telnet:// URI in a web page or HTTP redirect that a terminal browser (e.g., Lynx, Elinks) will follow.
3. Negotiate NEW_ENVIRON: Upon connection, the server sends a Telnet IAC DO NEW_ENVIRON negotiation, followed by IAC SB NEW_ENVIRON SEND USERVAR <VARNAME> IAC SE, requesting the value of a specific environment variable (e.g., AWS_SECRET_ACCESS_KEY, GITHUB_TOKEN, PASSWORD).
4. Receive leaked variable: The vulnerable GNU inetutils telnet client responds with the variable's value in plaintext within the Telnet protocol stream, which the attacker's server captures and displays.
5. Repeat for additional variables: The attacker can request multiple variables in sequence to harvest all sensitive credentials present in the client's environment (oss-security).

• Network: Outbound TCP connections from a user workstation to unexpected hosts on port 23 or non-standard ports initiated by the telnet binary; Telnet protocol traffic (IAC sequences \xff\xfd\x27 and \xff\xfa\x27\x01\x03) observed in packet captures indicating NEW_ENVIRON negotiation with USERVAR requests.
• Process: Unexpected execution of the system telnet binary, particularly spawned as a child of a web browser process (e.g., Lynx, Elinks); command-line arguments showing connection to unfamiliar IP addresses or hostnames.
• Logs: Shell history entries showing telnet connections to unknown hosts; system logs recording outbound connections from the telnet client process to external IPs on telnet ports.
• File System: Presence of envscraper or similarly named binaries on a server that may indicate an attacker has deployed the PoC tool (oss-security).

GNU inetutils versions after 2.7 contain a patch for this vulnerability; users should upgrade to the latest available release (Feedly). Debian has issued security advisories (DSA-6193-1 and DLA-4527-1) and Ubuntu has issued USN-8387-1 with updated inetutils packages (Debian LTS). As an immediate workaround, avoid connecting to untrusted telnet servers and consider replacing telnet with SSH entirely, as SSH does not expose client environment variables to servers in this manner. Users who must use telnet should unset sensitive environment variables before initiating a telnet session (e.g., unset AWS_SECRET_ACCESS_KEY && telnet <host>). Disabling telnet:// URI scheme handling in web browsers can prevent passive exploitation via malicious redirects.

The vulnerability was responsibly disclosed by Justin Swartz via the oss-security mailing list on March 13, 2026, with a detailed write-up and working PoC, noting it as a regression of CVE-2005-0488 and prompted by a suggestion from Solar Designer (oss-security). The Debian and Ubuntu security teams responded with patches within weeks. The Yocto Project security list also discussed the issue, indicating broad awareness across embedded Linux communities (Yocto Security). A NixOS issue was opened to track remediation in nixpkgs (NixOS Issue). Community reaction was measured, noting the limited real-world risk given telnet's declining use, but highlighting the concern for Debian/Ubuntu users where inetutils telnet became the default client.