Sudo Security Vulnerability Lets Attackers Escalate Privileges

A high-severity security vulnerability in Sudo could allow local attackers to bypass time-based access restrictions and run commands with elevated privileges.

Tracked as CVE-2026-96512, the flaw affects Sudo versions from 1.8.20 through 1.9.17p2 and involves unsafe handling of the TZ environment variable.

Sudo is a widely used Linux utility that lets approved users execute commands as another user, typically root. Administrators can use sudoers rules to limit when privileged commands may be run.

These rules may include NOTBEFORE and NOTAFTER conditions, preventing access before a defined date or after an access window expires.

The flaw lets unprivileged users manipulate Sudo’s timezone restrictions because parse_gentime() relies on mktime() and the environment’s TZ variable to process timestamps without explicit timezones.

Because Sudo is a setuid-root program and initially inherits the invoking user’s environment, a local user may define a specially crafted timezone value before launching a Sudo command.

An extreme POSIX timezone offset, such as TZ=XXX24, can shift Sudo’s interpretation of the authorization time by approximately 25 hours in either direction. This could make an expired NOTAFTER rule appear active or allow a NOTBEFORE rule to be used before its intended start time.

Sudo Security Vulnerability

The flaw does not bypass password authentication or Pluggable Authentication Modules, commonly called PAM. An attacker must still be an authenticated local user and must already have a Sudo rule that relies on affected time-based restrictions.

However, where administrators use time windows to grant temporary access to sensitive commands, the bug can undermine that security control and enable privilege escalation beyond the permitted schedule. The affected time-based authorization feature was introduced in Sudo 1.8.20.

Red Hat’s vulnerability record lists the issue as high severity and notes that Linux systems using vulnerable Sudo releases may be exposed when NOTBEFORE or NOTAFTER conditions are configured without explicit timezone information. Independent security researcher Ermenson Junior reported the issue on August 28, 2026.

Upstream Sudo maintainer Todd Miller committed a fix to the project’s main branch on August 29, 2026. The patch removes the user-controlled TZ variable from Sudo’s working environment while setting the timezone, preventing repeated calls to mktime() from using an attacker-provided timezone. At the time of disclosure, the fix had not yet been included in a released Sudo 1.9.18 version.

Organizations should identify systems running Sudo 1.8.20 through 1.9.17p2, review sudoers policies for NOTBEFORE and NOTAFTER entries, and apply vendor-provided updates once available.

Administrators should also use explicit UTC timestamps or timezone offsets in time-bound authorization rules where possible, reducing ambiguity during time calculations.

Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC