🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://www.offsec.com/blog/cve-2026-24061/
• Blog Title: CVE-2026-24061 – GNU InetUtils telnetd Authentication Bypass Vulnerability
• Suggested Section: Network Services Pentesting -> 23 - Pentesting Telnet (add CVE-2026-24061 + a subsection on Telnet NEW_ENVIRON abuses / argv-level option injection into /usr/bin/login)

🎯 Content Summary

What it is

CVE-2026-24061 is a critical authentication bypass in GNU InetUtils telnetd that lets an unauthenticated remote attacker obtain an immediate root shell by abusing Telnet NEW_ENVIRON to inject a malicious USER environment variable, which is then unsafely interpolated into the argument list for /usr/bin/login.

Affected component / versions / severity

• CVE ID: CVE-2026-24061
🔧 Technical Details

Telnet NEW_ENVIRON → privileged helper argv injection: When a Telnet daemon (or any network service) accepts client-controlled environment variables via protocol negotiation (e.g., Telnet NEW_ENVIRON) and then interpolates those values into a command template used to spawn a privileged helper (e.g., /usr/bin/login), the attacker can turn “data” into “options” by ensuring the injected value starts with -. This yields argv-level option injection, enabling authentication bypass or code execution if the helper supports dangerous flags (e.g., login -f <user> to skip authentication).

Defensive pattern (input sanitization for exec templates): Before substituting any untrusted value into arguments passed to exec*, enforce a strict character policy (reject leading -, reject whitespace and metacharacters, and/or use an allowlist). In this case, a sanitize() gate using 🤖 Agent Actions

Summary:

• Expanded the Telnet CVE-2026-24061 section with a deep-dive on NEW_ENVIRON-driven argv injection, exploitation flow, PoC, patch behavior, and verification commands.
• Updated references to include the OffSec blog, inetutils sanitize commit, and relevant CVE trackers with proper hyperlinks.

Tests:

• Not run (documentation-only changes).

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.