CVE-2026-24061 Exploit Metadata

PoC files

4 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

Analysisdeepseek-v4-pro:cloud · 2026-08-11

Technical assessment

Go exploit for CVE-2026-24061 that connects to a telnetd service, injects 'USER=-f root' via the NEW-ENVIRON option to bypass authentication, and provides an interactive root shell.

Backdoor review

No backdoor observed in reviewed code

The repository contains a proof-of-concept exploit for CVE-2026-24061, a telnetd authentication bypass. The Go code (poc.go) implements the described vulnerability by sending a crafted USER environment variable to gain a root shell. No backdoor, deceptive payload, or concealed operator-directed harm was observed. The code performs only the advertised exploit behavior: connecting to a target, negotiating telnet options, injecting the malicious USER value, and providing an interactive shell if successful.

ClassificationExploit

Model confidence98%

AuthenticationNot required

LanguagesGo

Target softwareGNU Inetutils telnetd

Attack typesauthentication bypassargument injection

Evidence & reasoningClassification basis · observed behavior · safety review

Technical evidence

Classification basis and observed behavior

Classification basis

The primary artifact poc.go contains complete code that actively exploits the vulnerability by connecting to a target, injecting a malicious environment variable to bypass authentication, and providing an interactive shell. This is exploitation, not mere detection or scanning.

poc.go:1-278README.md:39-47

Requirements

Target running vulnerable GNU Inetutils telnetd (versions 1.9.3 through 2.7)README.md:9
Network access to the target telnet portpoc.go:40-44

Observed behavior

Connects to a specified host and port via TCPpoc.go:44
Sends telnet protocol commands to negotiate NEW-ENVIRON and ENVIRON optionspoc.go:55-56
Injects the environment variable USER with value '-f root' to trigger authentication bypasspoc.go:54poc.go:142-153
Checks for absence of login prompt and presence of WILL ECHO to confirm successful bypasspoc.go:67-75
Executes 'id' command and verifies 'uid=' in output to confirm shell accesspoc.go:77-83
Provides an interactive shell session, reading commands from stdin and sending them to the targetpoc.go:92-109

Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Behavior: poc.go sends USER=-f root via telnet NEW-ENVIRON to bypass authentication and spawn a root shellThis is the exact behavior described in the README and CVE advisory for CVE-2026-24061. It is the intended purpose of the PoC.poc.go:54poc.go:142-153poc.go:88
Target Environment: Dockerfile builds a vulnerable GNU Inetutils 2.0 telnetd container with a test user and root password setThe Dockerfile sets up a lab environment for testing the exploit, consistent with the README instructions. It does not contain any backdoor or unrelated payload.Dockerfile:1-36

Review boundaries

What the analysis did not establish

One file (docker-compose.yml) is omitted from the evidence; its content is not available for analysis.
The evidence does not include the output of executing the exploit; classification is based solely on static code analysis.
One file (docker-compose.yml) was omitted from the text evidence and not reviewed. Its metadata indicates it is a text file, but its content was not provided. Based on the README, it is expected to be a standard Docker Compose orchestration file for the lab environment.

Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Docker lab environments

GitHub

docker-compose.yml

Created 2026-01-22Vuln labCVE-2026-24061Compose · builds

1 Compose manifest · 1 Dockerfile · 1 service

Analysisdeepseek-v4-pro:cloud · 2026-08-07

Environment assessment

A Docker Compose lab that builds and runs a vulnerable GNU Inetutils 2.0 telnetd server on Ubuntu 20.04, exposing it on host port 2323. The lab is designed to demonstrate CVE-2026-24061, an authentication bypass in telnetd.

docker-compose.yml:1-6Dockerfile:1-36README.md:1-70

Lab assessment

Vulnerability lab

The README explicitly describes a vulnerability (CVE-2026-24061), provides a PoC, and instructs users to build and run the container to test the exploit. The Dockerfile compiles a vulnerable version of GNU Inetutils and configures telnetd, and the Compose file orchestrates the service.

README.md:1-70Dockerfile:1-36docker-compose.yml:1-6

Lab shapeCompose · builds

Services1

Compose manifests1

Dockerfiles1

Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries

Components

Services and files described by the evidence

telnetd service

vulnerable targettelnet server

A container built from the provided Dockerfile, running xinetd with telnetd from GNU Inetutils 2.0. It listens on port 23 inside the container, mapped to host port 2323. The service is configured to allow telnet connections and is the target of the authentication bypass exploit.

docker-compose.yml:1-6Dockerfile:1-36

poc.go

exploit scriptproof-of-concept

A Go program that connects to the telnetd service, negotiates telnet options, injects USER=-f root via the NEW-ENVIRON option, and obtains a root shell if the target is vulnerable. It includes an interactive shell loop for post-exploitation commands.

poc.go:1-278README.md:1-70

CVE assessment

How the supplied evidence relates each vulnerability

CVE-2026-24061

Supported by supplied evidence

The README, Dockerfile, and PoC all reference CVE-2026-24061. The Dockerfile compiles GNU Inetutils 2.0, which falls within the affected version range (1.9.3–2.7) stated in the README. The PoC implements the described NEW-ENVIRON injection to bypass authentication.

README.md:1-70Dockerfile:1-36poc.go:1-278

Exercise context

Requirements and sequence described by the evidence

Prerequisites

Docker and Docker Compose must be installed to build and run the lab container.README.md:30-32
Go must be installed to run the PoC exploit.README.md:34-35
The lab container must be built and running before executing the PoC.README.md:30-35

Evidence-described exercise path

Build and start the vulnerable telnetd container using 'docker compose up --build -d'.README.md:30-32
Run the Go PoC against the target: 'go run poc.go 127.0.0.1 2323'.README.md:34-35
The PoC connects, injects USER=-f root, and if successful, provides an interactive root shell on the target container.poc.go:1-278README.md:1-70

Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

The lab is self-contained: it builds a vulnerable telnetd server inside a Docker container and provides a PoC that exploits that server. The exploit targets only the lab's own container over the mapped port. No evidence of host escape, external connectivity, persistence, credential theft, or destructive behavior beyond the intended vulnerability demonstration.

docker-compose.yml:1-6Dockerfile:1-36poc.go:1-278README.md:1-70

Review boundaries

What the analysis did not establish

The PoC binary is not inspected; only its source code (poc.go) is analyzed.
The Dockerfile downloads and compiles source from an external URL (https://ftp.gnu.org/gnu/inetutils/inetutils-2.0.tar.gz) during build, which is a supply-chain risk but is necessary for the lab setup.
The lab uses telnet, which transmits credentials in cleartext, but this is inherent to the vulnerability being demonstrated.

Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

Linked vulnerabilities

CVE-2026-24061