Sudo Vulnerability Lets Attackers Bypass Time-Based Authorization Controls
CVE-2026-96512 lets local users skew Sudo time-based authorization windows via the TZ variable.
A high-severity Sudo flaw, CVE-2026-96512, lets a local user influence NOTBEFORE and NOTAFTER sudoers checks through the TZ environment variable. Versions 1.8.20 through 1.9.17p2 are affected; parse_gentime() uses mktime(), which honors TZ, and an extreme offset such as TZ=XXX24 can shift the window by about 25 hours. The bug does not bypass PAM and requires an existing time-restricted rule. Upstream commit 1820a349687522f51023d1ae5925125f59679a8c removes TZ before timezone setup, but that fix was not yet in a released Sudo version; Red Hat tracks Bug 2539327.
- CVE-2026-96512 affects Sudo 1.8.20 through 1.9.17p2.
- Malicious TZ values can shift time-based sudoers windows by about 25 hours.
- Exploitation needs an existing time-restricted rule and still cannot bypass PAM.
- Upstream fix is committed but was not in a released Sudo package.
- Red Hat tracks the issue as Bug 2539327 at high severity.
- CVEs
- CVE-2026-96512
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-96512 | Time-window bypass via TZ manipulation in sudo NOTBEFORE/NOTAFTER rules | 7.8 | <1% | PoC ×2 |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| sha1 | 1820a349687522f51023d1ae5925125f59679a8c | m valid again. Upstream Sudo addressed this issue in commit 1820a349687522f51023d1ae5925125f59679a8c, authored by Todd Miller on August 29, 2026. The patch remo |
From the original article
2 min read at gbhackers.com
A recently disclosed high-severity vulnerability in Sudo could allow local, unprivileged Linux users to manipulate time-based authorization restrictions in sudoers policies. Tracked as CVE-2026-96512, this vulnerability arises from how Sudo handles the attacker-controlled TZ environment variable when evaluating NOTBEFORE and NOTAFTER constraints.
By Divya · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.