A critical vulnerability in the GNU InetUtils telnet daemon (telnetd) has been disclosed, tracked as CVE-2026-24061, affecting all versions from 1.9.3 up to 2.7. The flaw enables remote authentication bypass by exploiting a crafted USER environment value of "-f root" and passing telnet(1) the -a or --login parameter, causing login to proceed as root without normal authentication, according to a description in the NVD.
The issue arises because telnetd passes the USER value to login(1) without sanitisation, and login(1) uses the -f parameter to bypass authentication. The vulnerability was introduced in a source code commit on 19 March 2015, which reached version 1.9.3 on 12 May 2015, with security researcher Kyu Neushwaistein credited for discovery/reporting on 19 January 2026.
Mitigations include applying the latest patches and restricting Telnet access to trusted clients; temporary workarounds include disabling the telnetd server or using a custom login(1) tool that does not permit the -f parameter, as noted by Simon Josefsson. Data from GreyNoise shows 21 unique IP addresses attempting the remote‑authentication bypass in the last 24 hours, originating from Hong Kong, the U.S., Japan, the Netherlands, China, Germany, Singapore and Thailand. According to NIST National Vulnerability Database (NVD).