# GNU InetUtils telnetd Remote Authentication Bypass

## Vulnerability Information

- **Source**: oss-sec mailing list (seclists.org/oss-sec/2026/q1/89)
- **Affected Software**: GNU InetUtils telnetd
- **Affected Versions**: 1.9.3 through 2.7
- **Vulnerability Type**: Remote Authentication Bypass
- **Severity**: Critical
- **CVE**: Not yet assigned
- **Disclosure Date**: January 2026

## Summary

GNU InetUtils telnetd versions 1.9.3 through 2.7 contain a remote authentication bypass vulnerability. An unauthenticated attacker can gain root access to systems running the vulnerable telnetd service by exploiting improper sanitization of the USER environment variable.

## Technical Details

The vulnerability exists because telnetd passes the USER environment variable directly to the login(1) program without proper sanitization. The login program accepts a `-f` flag that bypasses password authentication entirely.

When a telnet client connects using the `-a` option (automatic login), the USER environment variable can be set to a value containing command-line flags. By setting `USER='-f root'`, the attacker tricks login(1) into interpreting `-f` as a flag rather than a username, effectively bypassing authentication and gaining root access.

### Attack Vector

```bash
USER='-f root' telnet -a localhost
```

This single command grants immediate root shell access on vulnerable systems.

### Root Cause

1. telnetd receives the USER environment variable from the client
2. telnetd passes USER to login(1) without sanitization
3. login(1) interprets `-f root` as:
   - `-f` flag: skip password authentication
   - `root` as the username to login as
4. Result: unauthenticated root access

## Affected Versions

- GNU InetUtils 1.9.3 (released 2015-03-05) through 2.7

The vulnerability was introduced in version 1.9.3 with commit that added support for the `-a` (AuthStrOption) feature.

## Patch Information

Patches are available on Codeberg:
- https://codeberg.org/inetutils/inetutils/commit/... (main fix)

The fix sanitizes the USER environment variable before passing it to login, ensuring that values starting with `-` are rejected or escaped.

## Reproduction Requirements

- GNU InetUtils telnetd version 1.9.3 to 2.7 installed and running
- Network access to the telnet service (port 23)
- A telnet client that supports the `-a` flag and USER environment variable

## Expected Behavior

- **Vulnerable**: `USER='-f root' telnet -a localhost` grants immediate root shell
- **Fixed**: Connection is rejected or prompts for password authentication

## References

- https://seclists.org/oss-sec/2026/q1/89
- https://www.gnu.org/software/inetutils/
- https://codeberg.org/inetutils/inetutils