CVE Feed

    Dashboard / CVE / CVE-2026-28372

    CVE-2026-28372

    telnetd in GNU inetutils through 2.7 allows privilege escalation that can be exploited by abusing systemd service credentials support added to the login(1) implementation of util-linux in release 2.40. This is related to client control over the CREDENTIALS_DIRECTORY environment variable, and requires an unprivileged local user to create a login.noauth file.

    Published:Feb 27, 2026
    Last Modified:Apr 16, 2026
    EPS:Feb 27, 2026
    EPSS Score:0.00007
    CVSS Score:7.4

    Affected Products

    Vendor
    Gnu
    Product
    Inetutils

    Exploits

    https://lists.gnu.org/archive/html/bug-inetutils/2026-02/msg00000.htmlhttps://github.com/kalibb/CVE-2026-28372-GNU-inetutils-telnetd-Privilege-Escalation-mainhttps://github.com/mbanyamer/CVE-2026-28372-GNU-inetutils-telnetd-Privilege-Escalationhttps://github.com/Rohitberiwala/CVE-2026-28372-telnetd-Privilege-Escalation

    Related CVEs

    CVE-2026-32772 (CVSS 3.4) — telnet in GNU inetutils through 2.7 allows servers to read arbitrary environment variables from clients via NE…
    CVE-2026-32746 (CVSS 9.8) — telnetd in GNU inetutils through 2.7 allows an out-of-bounds write in the LINEMODE SLC (Set Local Characters) …
    CVE-2026-24061 (CVSS 9.8) — telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root" value for the USER en…
    CVE-2023-40303 (CVSS 7.8) — GNU inetutils before 2.5 may allow privilege escalation because of unchecked return values of set*id() family …
    CVE-2022-39028 (CVSS 7.5) — telnetd in GNU Inetutils through 2.3, MIT krb5-appl through 1.0.3, and derivative works has a NULL pointer der…
    CVE-2021-40491 (CVSS 6.5) — The ftp client in GNU Inetutils before 2.2 does not validate addresses returned by PASV/LSPV responses to make…
    CVE-2011-4862 (CVSS 10) — Buffer overflow in libtelnet/encrypt.c in telnetd in FreeBSD 7.3 through 9.0, MIT Kerberos Version 5 Applicati…
    CVE-2004-1485 (CVSS 7.5) — Buffer overflow in the TFTP client in InetUtils 1.4.2 allows remote malicious DNS servers to execute arbitrary…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High