CVE-2026-24061
Fixed in a distro release ExploitedEPSS 99%CVSS 9.8
telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root" value for the USER environment variable.
Products: gnu inetutils
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 11 | inetutils | 2:2.0-1+deb11u3 |
| Debian 12 | inetutils | 2:2.4-2+deb12u2 |
| Debian 13 | inetutils | 2:2.6-3+deb13u1 |
| Debian 14 | inetutils | 2:2.7-2 |
| Ubuntu 22.04 LTS | inetutils | 2:2.2-2ubuntu0.2 |
| Ubuntu 24.04 LTS | inetutils | 2:2.5-3ubuntu4.1 |
| Ubuntu 25.10 | inetutils | 2:2.6-1ubuntu3.1 |
| Ubuntu Pro 16.04 LTS | inetutils | 2:1.9.4-1ubuntu0.1~esm5 |
| Ubuntu Pro 18.04 LTS | inetutils | 2:1.9.4-3ubuntu0.1+esm4 |
| Ubuntu Pro 20.04 LTS | inetutils | 2:1.9.4-11ubuntu0.2+esm3 |