Environment Variable Exposure in GNU Inetutils Telnet Server
CVE-2026-32772

3.4LOW

Key Information:

Vendor

Gnu
Status
Inetutils
Vendor
CVE Published:
13 March 2026

What is CVE-2026-32772?

A vulnerability in the telnet server component of GNU inetutils allows for the unauthorized reading of environment variables from connected clients. Through the NEW_ENVIRON SEND USERVAR command, malicious entities could exploit this flaw to obtain sensitive data, potentially compromising server integrity and client confidentiality. This exposes users to risks and emphasizes the need for vigilant security practices when utilizing telnet services.

Affected Version(s)

inetutils 0 <= 2.7

References

https://www.openwall.com/lists/oss-security/2026/03/13/1

CVSS V3.1

Score:
3.4
Severity:
LOW
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.