Sudo Vulnerability Lets Attackers Bypass Time-Based Authorization Controls

A recently disclosed high-severity vulnerability in Sudo could allow local, unprivileged Linux users to manipulate time-based authorization restrictions in sudoers policies.

Tracked as CVE-2026-96512, this vulnerability arises from how Sudo handles the attacker-controlled TZ environment variable when evaluating NOTBEFORE and NOTAFTER constraints.

Red Hat is monitoring this flaw under Bug 2539327, which is currently categorized as high severity and high priority. The vulnerability impacts Sudo versions from 1.8.20 to 1.9.17p2. While an upstream fix has been committed, it had not yet been included in a released version of Sudo at the time of disclosure.

Sudo Vulnerability

Sudoers policies can utilize the NOTBEFORE and NOTAFTER tags to restrict when a user may execute commands with elevated privileges. Organizations may rely on these controls for temporary administrative access, maintenance windows, emergency access workflows, or scheduled privilege assignments.

The vulnerability occurs in Sudo’s `parse_gentime()` function, which handles time values lacking an explicit timezone suffix, such as a trailing “Z” for UTC or a numerical UTC offset.

The affected code uses the `mktime()` function to interpret these timestamps. However, `mktime()` relies on the TZ variable from the process environment to determine the timezone.

Since Sudo is a setuid-root program and inherits part of the invoking user’s environment, a local attacker can provide a malicious TZ value that influences how Sudo interprets the configured authorization window.

According to the advisory, an attacker may use an extreme POSIX timezone offset, such as TZ=XXX24, to shift the effective policy time by up to about 25 hours in either direction. This can make an expired NOTAFTER rule appear active, or allow a NOTBEFORE restriction to be treated as already valid.

This flaw does not grant arbitrary root access to every local user. An attacker must already have access to a Sudo rule that is restricted by time and must be able to satisfy the rule’s other requirements.

Importantly, this issue does not bypass PAM authentication; if a Sudo policy requires a password, multifactor authentication, or another PAM-controlled authentication mechanism, the user must still complete that step. The vulnerability specifically impacts the time-based authorization decision.

Nevertheless, this bug can be significant in environments where temporary Sudo permissions serve as a compensating control. For example, an administrator may be permitted to run a privileged maintenance command only until a defined expiration time. A user with an expired entitlement could potentially manipulate their TZ environment to make the rule seem valid again.

Upstream Sudo addressed this issue in commit 1820a349687522f51023d1ae5925125f59679a8c, authored by Todd Miller on August 29, 2026. The patch removes the TZ variable from Sudo’s working environment before setting the timezone, preventing user-supplied timezones from influencing `mktime()` and related time-processing behaviors.

Administrators should monitor distribution security advisories and apply vendor-provided Sudo updates as soon as they become available. Until patches are deployed, teams should identify sudoers entries using NOTBEFORE or NOTAFTER, particularly policies that grant sensitive command execution or are meant to expire automatically.

Organizations should also avoid relying solely on time-bound sudoers rules for high-risk privilege control. Combining temporary authorization with centrally enforced identity controls, short-lived credentials, logging, and periodic reviews of sudoers policies can reduce exposure if local policy evaluation weaknesses emerge.

Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC