Login Request a demo
High severity · published Feb 27, 2026
CVE-2026-28372
telnetd in GNU inetutils through 2.7 allows privilege escalation that can be exploited by abusing systemd service credentials support added to the login(1) implementation of…
7.8
CVSS
0.4%
EPSS
No
On KEV
Description
telnetd in GNU inetutils through 2.7 allows privilege escalation that can be exploited by abusing systemd service credentials support added to the login(1) implementation of util-linux in release 2.40. This is related to client control over the CREDENTIALS_DIRECTORY environment variable, and requires an unprivileged local user to create a login.noauth file.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 36% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IN
Inetutils · Gnu
through 2.7 · source: NVD
Affected product
IN
Inetutils
Gnu
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-28372
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-28372
Patch
https://git.hadrons.org/cgit/debian/pkgs/inetutils.git/commit/?id=3953943d8296310485f98963883a798545ab9a6c
Exploit
https://lists.gnu.org/archive/html/bug-inetutils/2026-02/msg00000.html
Mailing List
https://lists.gnu.org/archive/html/bug-inetutils/2026-02/msg00012.html
Mailing List
https://www.openwall.com/lists/oss-security/2026/02/24/1
Mailing List
http://www.openwall.com/lists/oss-security/2026/02/27/3
www.openwall.com
http://www.openwall.com/lists/oss-security/2026/03/06/2
More from Inetutils
9.8
CVE-2026-24061
GNU InetUtils Argument Injection Vulnerability
9.8
CVE-2026-32746
telnetd in GNU inetutils through 2.7 allows an out-of-bounds write in the LINEMODE SLC (Set Local Characters) suboption handler because add_slc does not check whether the buffer…
7.8
CVE-2023-40303
GNU inetutils before 2.5 may allow privilege escalation because of unchecked return values of set*id() family functions in ftpd, rcp, rlogin, rsh, rshd, and uucpd
7.5
CVE-2022-39028
telnetd in GNU Inetutils through 2.3, MIT krb5-appl through 1.0.3, and derivative works has a NULL pointer dereference via 0xff 0xf7 or 0xff 0xf8
6.5
CVE-2021-40491
The ftp client in GNU Inetutils before 2.2 does not validate addresses returned by PASV/LSPV responses to make sure they match the server address