Telnetd Authentication Bypass via Login Flag (CVE-2026-24061)

Aaron Beardslee@abeardslee

•updated Jan 29, 2026•8•1•139

Detects the GNU telnetd service spawning the login binary with the '-f' flag, which is used to skip authentication. This is the primary indicator of the CVE-2026-24061 exploitation. This detection requires process creation logging on Linux, which can be enabled via tools like Sysmon for Linux.