Sudo Time-Based Access Control Flaw in Sudo Software by Sudo Project
CVE-2026-96512

7.8HIGH

Key Information:

Vendor: Red Hat
Status: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 10.0 Extended Update Support; Red Hat Enterprise Linux 7 Extended Lifecycle Support; Red Hat Enterprise Linux 8
Vendor: CVE Published:; 23 September 2026

What is CVE-2026-96512?

CVE-2026-96512 is a vulnerability affecting the Sudo software, a widely used program that allows users to execute commands with elevated privileges. This particular flaw relates to the time-based access control mechanisms within Sudo, specifically impacting rules that use NOTBEFORE or NOTAFTER restrictions. When timestamps used in these rules lack the trailing 'Z' timezone indicator, the evaluation of time access is influenced by the TZ environment variable of the calling user. Since Sudo operates with setuid-root, a security model that allows a program to run with elevated privileges, an unprivileged local user can manipulate the TZ variable to an extreme timezone offset. This manipulation can extend the authorization window, allowing users to bypass intended time limitations and execute commands even when they should be restricted due to expired time-based rules. While this vulnerability does not allow for authentication bypass, it undermines the time-based authorization checks, posing significant risk for organizations reliant on Sudo for secure command execution.

Potential impact of CVE-2026-96512

Unauthorized Command Execution: The vulnerability can enable unprivileged users to execute commands beyond the designated time constraints, potentially leading to unauthorized access to sensitive system functions or information that should be restricted.
Circumvention of Security Policies: Organizations often implement time-based access controls as part of their security policies. This flaw can allow attackers to circumvent these controls, which may result in critical tasks being executed outside acceptable operational windows.
Risk of Data Loss or Corruption: By exploiting this vulnerability, attackers may impact data integrity or disrupt the functioning of applications that depend on proper command execution timing, potentially leading to data loss or corruption, and impacting overall system reliability.