CVE-2026-35535

A flaw was found in Sudo, rated IMPORTANT by Red Hat, that can allow a local user to escalate privileges on systems running affected versions of the sudo package in Red Hat Enterprise Linux and in other affected Red Hat products such as OpenShift Container Platform 4. When Sudo needs to notify the system administrator by mail (for example, when it encounters an error while parsing /etc/sudoers), it drops its root privileges by calling setuid(), setgid(), and setgroups() before executing the mailer. In Sudo through 1.9.17p2, a failure of these privilege-drop calls was not treated as a fatal error, creating a fail-open condition in which the mailer could be executed with full root privileges instead of those of the invoking user. A local attacker who is able to cause these calls to fail, for example by using a Linux security module such as AppArmor to deny the CAP_SETUID capability to Sudo, could leverage this behavior, in combination with a mailer such as Postfix's sendmail, to execute arbitrary commands as root and gain full root privileges on the system. Red Hat rates this flaw CVSS 3.1 7.4 (AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), while NIST rates it 7.8 with low attack complexity; the higher Red Hat attack complexity reflects that exploitation requires an environment in which the privilege-drop syscalls fail, which is not the case in a default installation. Fedora is not affected because the vulnerable code is not present in its sudo packages. For the affected Red Hat products, fixes are being pursued and delivered through their standard update streams.