01
detectionlint / library / spl

Linux Telnet Authentication Bypass

splApache-2.0from splunk/security_content

Detects an authentication bypass in telnet tracked as CVE-2026-24061. An attacker can supply a specifically crafted USER environment variable (-f root) that is passed to /usr/bin/login. Because this input isn't sanitized an attacker can force the system to skip authentication and login directly as root.

02
quality67
fp risk—
forks0
views1
rule sourcelocked

Sign in to view the rule source

Free accounts can view the source for the top-ranked rules. Create one in seconds — no credit card required.

Sign in
Linux Telnet Authentication Bypass · SPL rule | DetectionLint