GNU inetutils telnetd Local Privilege Escalation via NEW-ENVIRON Injection — CVE-2026-28372

Metadata

Affected Target

Summary

GNU inetutils telnetd forwards client-controlled environment variables — negotiated via the Telnet NEW-ENVIRON option — to the login(1) process it spawns without adequately sanitizing them. On systems where the installed login (from util-linux) supports a CREDENTIALS_DIRECTORY-relative login.noauth marker file, an attacker can set CREDENTIALS_DIRECTORY to a directory they control and place a login.noauth file containing yes in it. When telnetd invokes login, it trusts this untrusted, attacker-supplied directory and treats the session as pre-authenticated, granting a root shell without a valid password. The PoC automates creation of the malicious directory/marker file and connects to telnetd with the crafted environment variable to demonstrate the bypass.

Vulnerability Details

Root Cause

telnetd passes client-supplied NEW-ENVIRON variables (including CREDENTIALS_DIRECTORY) through to login(1) without validating that the value originates from a trusted source, allowing an attacker-controlled directory containing a login.noauth marker to be treated as an authoritative “already authenticated” signal.

Attack Vector

1. Create a local, attacker-writable directory containing a file named login.noauth with contents yes.
2. Connect to the local telnetd service using the Telnet NEW-ENVIRON option to inject CREDENTIALS_DIRECTORY pointing at that attacker-controlled directory.
3. telnetd invokes login(1), which reads the untrusted CREDENTIALS_DIRECTORY/login.noauth marker and bypasses password authentication, granting a root shell.

Impact

An unprivileged local user (or anyone able to reach the telnetd service) can escalate to root without valid credentials, resulting in full local privilege escalation.

Environment / Lab Setup

Target:   Linux host running GNU inetutils telnetd <= 2.7, paired with a util-linux login supporting login.noauth
Attacker: Python 3, system `telnet` client binary, local/loopback network access to the telnetd service

Proof of Concept

PoC Script

See exploit.py in this folder.

1

python3 exploit.py --host 127.0.0.1

The script creates a temporary directory with a login.noauth marker file, sets CREDENTIALS_DIRECTORY to that directory in the environment, and invokes the system telnet client with NEW-ENVIRON options against the target telnetd, triggering the authentication bypass. Note: the shipped exploit.py invokes TelnetdExploit().run() under a guard with a typo (if name == "__main__": instead of if __name__ == "__main__":), so it must be run via python3 -c "from exploit import TelnetdExploit; TelnetdExploit().run()" or with the guard corrected before the automated trigger fires.

Detection & Indicators of Compromise

Signs of compromise:

• telnetd sessions that reach a root shell without a corresponding password prompt/entry in auth logs.
• CREDENTIALS_DIRECTORY environment values referencing non-standard, world-writable, or temporary directories.
• Unexpected login.noauth files present on the filesystem outside systemd-managed credential paths.

Remediation

References

• Source repository

Notes

Mirrored from https://github.com/Rohitberiwala/CVE-2026-28372 on 2026-07-05.