CVE-2026-32772 Information disclosure in inetutils

Low 3.4 Published 13 Mar 2026 Updated 16 Mar 2026

A malicious telnet server can read arbitrary environment variables from connecting clients, potentially exposing sensitive configuration data.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2026-32772?

CVE-2026-32772 is a low-severity vulnerability in GNU inetutils, published on 13 Mar 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

telnet in GNU inetutils through 2.7 allows servers to read arbitrary environment variables from clients via NEW_ENVIRON SEND USERVAR.

Weakness: CWE-669

Which versions are affected by CVE-2026-32772?

It affects 1 product.

Products include Gnu Inetutils.

How do I fix CVE-2026-32772?

Upgrade to a fixed version.

Is CVE-2026-32772 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-32772 exists.

Sources

Also known as DEBIAN-CVE-2026-32772, GHSA-5p6r-4c7p-96fh, UBUNTU-CVE-2026-32772.