REPRO-2026-00077: Verified Repro With Script Download

REPRO-2026-00077: GNU InetUtils telnetd Remote Authentication Bypass

Download script Open in Codespaces

REPRO-2026-00077 is verified against inetutils · gnu. Affected versions: 1.9.3 - 2.7. Vulnerability class: Auth Bypass. This critical reproduction includes runnable sandbox proof, artifacts, and a plain-text agent view under REPRO-2026-00077.

REPRO-2026-00077 inetutils · gnu Auth Bypass Jan 21, 2026 .txt

Severity

CRITICAL

Confidence

HIGH

Reproduced in

35m 50s

Tool calls

300

What Is REPRO-2026-00077?

REPRO-2026-00077 reproduces a critical remote authentication bypass in GNU InetUtils telnetd (versions 1.9.3 through 2.7), where the daemon accepts the client-supplied USER environment variable and passes it unsanitized to login(1). Pruva reproduced it (reproduction REPRO-2026-00077).

02 · Severity & CVSS

REPRO-2026-00077 Severity

REPRO-2026-00077 is rated critical severity.

CRITICAL threat level

Critical — the most severe class — typically remotely exploitable with severe impact. Treat as an emergency.

03 · Affected Versions

Affected inetutils Versions

inetutils · gnu versions 1.9.3 - 2.7 are affected.

05 · How to Reproduce

Download script Open in Codespaces →

$ pruva-verify REPRO-2026-00077

or

curl -O https://pruva.dev/api/v1/reproductions/REPRO-2026-00077/artifacts/reproduction_steps.sh && chmod +x reproduction_steps.sh && ./reproduction_steps.sh

Run in a VM or disposable container. This exploits a real vulnerability.

06 · Proof of Reproduction

Proof of Reproduction for REPRO-2026-00077

Reproduced by Pruva's autonomous agents — 300 tool calls over 36 min. Full root-cause analysis and the complete transcript are below.

How the agent worked 435 events · 300 tool calls · 36 min

36 minDuration

300Tool calls

132Reasoning steps

435Events

Agent activity over 36 min

Support

2

Repro

430

0:0035:49

Root Cause and Exploit Chain for REPRO-2026-00077

telnetd passes USER environment variable directly to login(1) without validation. When USER begins with -f root, login interprets -f as a flag to skip authentication.

REPRO-2026-00077 Reproduction Transcript

The agent's step-by-step process — every tool call, every handoff, the moment the exploit fired.

Full session Replay every step — scrub the timeline or play it back.

Event 1/40

0:00

support

repro

1:30

0:00

session startedgpt-5-codex · inetutils-telnetd-auth-bypass · 9fd7d2b1

0:10

extract_facts

output{"stored": true, "fact_count": 2}

0:10

0:11

supportrepro

0:11

supportrepro

0:14

0:14

0:14

0:18

0:18

$ls -la

✓

total 29
drwxr-xr-x 6 root root 4096 Jan 21 08:45 .
drwxr-xr-x 4 root root 4096 Jan 21 08:45 ..
drwxr-xr-x 3 root root 4096 Jan 21 08:45 artifacts
drwxr-xr-x 2 root root 4096 Jan 21 08:45 coding
-rw-r--r-- 1 root root  697 Jan 21 08:45 handoffs.jsonl
drwxr-xr-x 2 root root 4096 Jan 21 08:45 logs
drwxr-xr-x 2 root root 4096 Jan 21 08:45 repro

0:18

$

✓

{"output":"{\"returncode\": 0, \"stdout\": \"total 29\\ndrwxr-xr-x 6 root root 4096 Jan 21 08:45 .\\ndrwxr-xr-x 4 root root 4096 Jan 21 08:45 ..\\ndrwxr-xr-x 3 root root 4096 Jan 21 08:45 artifacts\\ndrwxr-xr-x 2 root ro"}

0:21

0:21

$ls -la /home/user/pruva/artifacts/runs/inetutils-telnetd-auth-bypass/20260121-084502/repo

✓

total 8
drwxr-xr-x 2 root root 4096 Jan 21 08:45 .
drwxr-xr-x 4 root root 4096 Jan 21 08:45 ..

0:21

$

✓

{"output":"{\"returncode\": 0, \"stdout\": \"total 8\\ndrwxr-xr-x 2 root root 4096 Jan 21 08:45 .\\ndrwxr-xr-x 4 root root 4096 Jan 21 08:45 ..\\n\", \"stderr\": \"\", \"cwd\": \"/home/user/pruva/artifacts/runs/inetutils-telnet"}

0:25

0:25

$

ls -la /home/user/pruva/artifacts/runs/inetutils-telnetd-auth-bypass/20260121-084502/inetutils-telnetd-auth-bypass/artifacts/prepped

✓

total 8
drwxr-xr-x 2 root root 4096 Jan 21 08:45 .
drwxr-xr-x 3 root root 4096 Jan 21 08:45 ..

0:25

$

✓

{"output":"{\"returncode\": 0, \"stdout\": \"total 8\\ndrwxr-xr-x 2 root root 4096 Jan 21 08:45 .\\ndrwxr-xr-x 3 root root 4096 Jan 21 08:45 ..\\n\", \"stderr\": \"\", \"cwd\": \"/home/user/pruva/artifacts/runs/inetutils-telnet"}

0:28

0:28

$git --version

✓

git version 2.43.0

0:28

$python3 --version

✓

Python 3.11.14

0:28

0:28

0:35

0:35

$id

✓

uid=0(root) gid=0(root) groups=0(root)

0:35

$

✓

{"output":"{\"returncode\": 0, \"stdout\": \"uid=0(root) gid=0(root) groups=0(root)\\n\", \"stderr\": \"\", \"cwd\": \"/home/user/pruva/artifacts/runs/inetutils-telnetd-auth-bypass/20260121-084502/inetutils-telnetd-auth-bypas"}

0:47

0:47

1:06

$git clone https://codeberg.org/inetutils/inetutils.git /tmp/inetutils

18.8s✓

Cloning into '/tmp/inetutils'...

1:06

$

18.8s✓

{"output":"{\"returncode\": 0, \"stdout\": \"\", \"stderr\": \"Cloning into '/tmp/inetutils'...\\n\", \"cwd\": \"/home/user/pruva/artifacts/runs/inetutils-telnetd-auth-bypass/20260121-084502/inetutils-telnetd-auth-bypass\"}"}

1:09

1:09

$git -C /tmp/inetutils tag -l | tail -n 20

✓

inetutils-1_9_1_100
inetutils-1_9_2
inetutils-1_9_3
inetutils-1_9_4
make-3-75-91
make-3-75-92
make-3-75-93
make-3-76

1:09

$

✓

{"output":"{\"returncode\": 0, \"stdout\": \"inetutils-1_9_1_100\\ninetutils-1_9_2\\ninetutils-1_9_3\\ninetutils-1_9_4\\nmake-3-75-91\\nmake-3-75-92\\nmake-3-75-93\\nmake-3-76\\nmake-3-76-1\\nv1.9.4.90\\nv1.9.4.91\\nv2.0\\nv2.1\\"}

1:14

1:20

$apt-get update

5.9s✓

Hit:1 https://storage.googleapis.com/bazel-apt stable InRelease
Get:2 http://security.ubuntu.com/ubuntu noble-security InRelease [126 kB]
Hit:3 http://archive.ubuntu.com/ubuntu noble InRelease
Get:4 http://archive.ubuntu.com/ubuntu noble-updates InRelease [126 kB]
Hit:5 https://ppa.launchpadcontent.net/deadsnakes/ppa/ubuntu noble InRelease
Hit:6 https://ppa.launchpadcontent.net/ondrej/php/ubuntu noble InRelease
Get:7 http://archive.ubuntu.com/ubuntu noble-backports InRelease [126 kB]
Get:8 http://archive.ubuntu.com/ubuntu noble-updates/multiverse amd64 Packages [35.9 kB]

1:20

$

5.9s✓

{"output":"{\"returncode\": 0, \"stdout\": \"Hit:1 https://storage.googleapis.com/bazel-apt stable InRelease\\nGet:2 http://security.ubuntu.com/ubuntu noble-security InRelease [126 kB]\\nHit:3 http://archive.ubuntu.com"}

1:21

1:26

$apt-get install -y build-essential autoconf automake libtool pkg-config bison flex

5.2s✓

Reading package lists...
Building dependency tree...
Reading state information...
build-essential is already the newest version (12.10ubuntu1).
autoconf is already the newest version (2.71-3).
automake is already the newest version (1:1.16.5-1.3ubuntu1).
libtool is already the newest version (2.4.7-7build1).
pkg-config is already the newest version (1.8.1-2build1).

1:26

$

5.2s✓

{"output":"{\"returncode\": 0, \"stdout\": \"Reading package lists...\\nBuilding dependency tree...\\nReading state information...\\nbuild-essential is already the newest version (12.10ubuntu1).\\nautoconf is already the"}

1:30

1:30

$git -C /tmp/inetutils checkout v2.7

0.2s✓

Note: switching to 'v2.7'.

You are in 'detached HEAD' state. You can look around, make experimental
changes and commit them, and you can discard any commits you make in this
state without impacting any branches by switching back to a branch.

If you want to create a new branch to retain commits you create, you may
do so (now or later) by using -c with the switch command. Example:

Artifacts and Evidence for REPRO-2026-00077

Scripts, logs, diffs, and output captured during the reproduction.

No artifacts available

08 · How to Fix

How to Fix REPRO-2026-00077

Coming soon

Step-by-step mitigation and hardening guidance for REPRO-2026-00077 — configuration checks, workarounds where no patch exists, and how to verify you're protected — is on the way.

FAQ: REPRO-2026-00077

How does the telnetd authentication-bypass attack work?

An attacker sets the client-side USER environment variable to a value beginning with -f root before connecting; because telnetd passes this unsanitized to login(1), login interprets the leading -f as its flag to skip authentication and log in as the given user, letting the attacker log in as root without a password.

Which versions of GNU InetUtils telnetd are affected?

GNU InetUtils telnetd versions 1.9.3 through 2.7 are affected.

How severe is this vulnerability?

Rated critical severity - it results in a full authentication bypass leading to unauthenticated root login.

How can I reproduce this vulnerability?

Download the verified script and run it in an isolated environment against GNU InetUtils telnetd 1.9.3-2.7; it connects with the telnet client's USER environment variable set to a -f root-style value and confirms the daemon logs the attacker in as root without a password.

11 · References

References for REPRO-2026-00077

Authoritative sources for REPRO-2026-00077 — official vulnerability databases and the upstream advisory. Pruva's reproduction verifies the issue firsthand; these are the primary records to corroborate it.

seclists.org Vendor advisory / patch