CVE-2026-28372
HighCVSS 7.4Summary
telnetd in GNU inetutils through 2.7 allows privilege escalation by abusing systemd service credentials support added to the login(1) implementation of util-linux in release 2.40. The issue relates to client control over the CREDENTIALS_DIRECTORY environment variable and requires an unprivileged local user to create a login.noauth file.
Risk Assessment
A local unprivileged user can escalate privileges on the system, potentially leading to full host compromise. This requires a specific system configuration with telnetd and util-linux 2.40.
Recommendation
Update GNU inetutils and util-linux to versions containing the fix. Consider disabling the telnetd service if it is not required.
Other vulnerabilities in GNU inetutils
See all- CVE-2026-32746Medium
telnetd in GNU inetutils through 2.7 allows an out-of-bounds write in the LINEMODE SLC (Set Local Characters) suboption handler because add_slc does not check whether the buffer is full.
- CVE-2026-32772Medium
A vulnerability in telnet in GNU inetutils through version 2.7 allows servers to read arbitrary environment variables from clients via the NEW_ENVIRON SEND USERVAR command.
- CVE-2023-40303High
GNU inetutils before 2.5 may allow privilege escalation due to unchecked return values of set*id() family functions in ftpd, rcp, rlogin, rsh, rshd, and uucpd.
Original NVD description (English source)
telnetd in GNU inetutils through 2.7 allows privilege escalation that can be exploited by abusing systemd service credentials support added to the login(1) implementation of util-linux in release 2.40. This is related to client control over the CREDENTIALS_DIRECTORY environment variable, and requires an unprivileged local user to create a login.noauth file.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS