CVE-2026-96512
Description
A flaw was found in sudo. When sudoers rules use NOTBEFORE or NOTAFTER time-based access restrictions with timestamps that omit the trailing 'Z' timezone indicator, the time evaluation relies on the TZ environment variable inherited from the calling user. Because sudo is a setuid-root program, an unprivileged local user can set TZ to an extreme timezone offset to shift the authorization window by up to approximately 25 hours, causing expired rules to be treated as valid. This allows the user to execute commands outside the intended time window. Authentication is not bypassed; only the time-based authorization check is affected.
Statement
This vulnerability is rated as Important severity because a local authenticated user can bypass time-based sudoers restrictions and execute privileged commands outside the configured validity window. Exploitation requires a sudoers rule with NOTBEFORE or NOTAFTER timestamps that omit the trailing 'Z' suffix, and the attacker must be the subject of such a rule. This is an optional feature not enabled in default configurations. PAM authentication is unaffected; the attacker cannot gain access beyond what the sudoers rule already grants. Sudo calls unsetenv("TZ") and tzset() early in startup as a partial defense, but upstream accepted and fixed the vulnerability, indicating this control is insufficient on at least some platforms. Red Hat ships sudo in all supported RHEL versions (RHEL 7 through RHEL 10 and RHIVOS). Red Hat product impact analysis for specific streams is pending affect filing.
Mitigation
Append the 'Z' timezone suffix to all NOTBEFORE and NOTAFTER timestamps in sudoers rules. For example, change 'NOTAFTER=20261231235959' to 'NOTAFTER=20261231235959Z'. Timestamps with the 'Z' suffix are interpreted as UTC via timegm() and are not affected by the TZ environment variable. Administrators can audit their sudoers configuration with: grep -rE 'NOT(BEFORE|AFTER)=' /etc/sudoers /etc/sudoers.d/ and verify that all timestamps end with 'Z'.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 7.8 | N/A | 7.8 |
| Attack Vector | Local | N/A | Local |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | Low | N/A | Low |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | High | N/A | High |
| Integrity Impact | High | N/A | High |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
cve.org: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Red Hat CVSS v3 Score Explanation
Local authorization bypass in setuid-root program; trivial exploit via TZ env var bypasses time-based access control
Understanding the Weakness (CWE)
Confidentiality
Technical Impact: Read Application Data; Read Files or Directories
An attacker could bypass intended access restrictions to read sensitive data, either by reading the data directly from a data store that is not correctly restricted, or by accessing insufficiently-protected, privileged functionality to read the data.
Integrity
Technical Impact: Modify Application Data; Modify Files or Directories
An attacker could bypass intended access restrictions to modify sensitive data, either by writing the data directly to a data store that is not correctly restricted, or by accessing insufficiently-protected, privileged functionality to write the data.
Access Control
Technical Impact: Gain Privileges or Assume Identity; Bypass Protection Mechanism
An attacker could bypass intended access restrictions to gain privileges by modifying or reading critical data directly, or by accessing privileged functionality.
Confidentiality,Integrity,Availability
Technical Impact: Execute Unauthorized Code or Commands
An attacker could use elevated privileges to execute unauthorized commands or code.
Availability
Technical Impact: DoS: Crash, Exit, or Restart; DoS: Resource Consumption (CPU); DoS: Resource Consumption (Memory); DoS: Resource Consumption (Other)
An attacker could gain unauthorized access to resources on the system and excessively consume those resources, leading to a denial of service.
Acknowledgements
Upstream acknowledges Ermenson Junior (Independent security research) as the original reporter.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
