Privilege Escalation Vulnerability in GNU Inetutils Telnetd

CVE-2026-28372

What is CVE-2026-28372?

The telnetd component of GNU Inetutils versions prior to 2.7 has a privilege escalation vulnerability that allows unprivileged local users to exploit the systemd service credentials support. By creating a malicious login.noauth file, attackers can manipulate the CREDENTIALS_DIRECTORY environment variable, potentially gaining elevated privileges on the system.

References