What it is
GNU InetUtils contains an argument injection vulnerability in telnetd that could allow for remote authentication bypass via a "-f root" value for the USER environment variable.
What to do
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Vendor notices and references
- codeberg.org/inetutils/inetutils/commit/ccba9f748aa8d50a38d7748e2e60362edd6a32cc
- codeberg.org/inetutils/inetutils/commit/fd702c02497b2f398e739e3119bed0b23dd7aa7b
- nvd.nist.gov/vuln/detail/CVE-2026-24061
Description and required action as published by CISA. Full record at NVD.
Other GNU entries on the list
- GNU Bash GNU Bash OS Command Injection Vulnerability CVE-2014-6278 · Oct 2, 2025
- GNU C Library GNU C Library Buffer Overflow Vulnerability CVE-2023-4911 · Nov 21, 2023
- Bourne-Again Shell (Bash) GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability CVE-2014-7169 · Jan 28, 2022
- Bourne-Again Shell (Bash) GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability CVE-2014-6271 · Jan 28, 2022