Do Son 
TL;DR
Security researchers recently disclosed a high-severity Sudo security vulnerability tracked as CVE-2026-96512. This flaw allows local users to bypass time-based access restrictions by manipulating timezone environment variables. System administrators must append a trailing ‘Z’ suffix to all time-restricted sudoers rules to mitigate this issue.
- CVE: CVE-2026-96512
- CVSS: 7.8 (High · CVSSv3)
- Product: Red Hat Hardened Images
- Impact: Sudo: sudo: tz environment variable allows bypass of notbefore/notafter time-based authorization
- Status: No confirmed exploitation yet
- Patched in: 1.9.17-16.p2.2.hum1
- EPSS: 0.1% (30-day)
- Action: Update to 1.9.17-16.p2.2.hum1 now
Track every CVE that hits your stack the moment it's exploited.
Get free email alertsWhy It Matters
Sudo operates as a setuid-root program on nearly all Linux distributions. Sourced industry estimates show that millions of Linux and Unix servers run sudo for privileged command execution. Therefore, a Sudo security vulnerability that alters authorization checks introduces significant risks. The flaw carries a high CVSS base score of 7.8.
Fortunately, researchers have not confirmed any active exploitation in the wild. Additionally, no public proof-of-concept exploit code currently exists. The vulnerability only affects systems utilizing optional time-based rules, limiting the overall exposure footprint. PAM authentication remains intact, meaning attackers cannot gain access beyond what their original sudoers rule grants.
How The Attack Works
The vulnerability targets the NOTBEFORE and NOTAFTER parameters within sudoers rules. When administrators write these timestamps without the trailing ‘Z’ timezone indicator, the application relies on the caller’s environment. Specifically, the time evaluation trusts the TZ environment variable inherited from the calling user.
An unprivileged local attacker can set this TZ variable to an extreme offset. The advisory notes, “an unprivileged local user can set TZ to an extreme timezone offset to shift the authorization window by up to approximately 25 hours, causing expired rules to be treated as valid.” This action grants the user command execution rights outside the intended time window.
Affected Versions
This authorization bypass affects Sudo versions 1.8.20 through 1.9.17p2 across multiple distributions. Red Hat confirmed that this issue impacts all supported versions from RHEL 7 through RHEL 10 and RHIVOS.
Patch Or Mitigation Steps
Upstream maintainers committed a fix to the project repository. You can review the official patch on GitHub at commit 1820a349687522f51023d1ae5925125f59679a8c and track the Red Hat response via Bugzilla 2539327.
Until a final release becomes available, administrators must update their configurations manually. Append the ‘Z’ timezone suffix to all NOTBEFORE and NOTAFTER timestamps to enforce UTC interpretation. For example, change ‘NOTAFTER=20261231235959’ to ‘NOTAFTER=20261231235959Z’. This simple modification forces the application to ignore the attacker-controlled TZ variable entirely.
Support Our Threat Intelligence
Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
