Critical Policy Bypass Vulnerability in sudo Package - CVE-2026-82474
Summary
ALSA-2026:68692: Important: sudo security, bug fix, and enhancement update. Affects sudo versions < 1.9.17-10.p2.el10_2.6. Fixed in 1.9.17-10.p2.el10_2.6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The sudo package is a widely used utility that allows system administrators to grant specific users the ability to execute privileged commands without needing to log in as the root user. This functionality is essential for system management and security, as it enables controlled access to critical system functions. The sudo utility is integral to many Linux distributions, including AlmaLinux, where it is utilized to enhance security and manage user permissions effectively.
Vulnerability Detail
The vulnerability identified as CVE-2026-82474 is a policy bypass issue within the sudo package. This flaw allows unauthorized program execution via the execveat system call, potentially enabling malicious users to execute commands that should be restricted. The implications of this vulnerability are significant, as it could lead to unauthorized access to sensitive system functions, compromising the integrity and security of the system.
How To Fix
Minimum fixed version
1.9.17-10.p2.el10_2.6
This is the first release that contains the fix.
sudo dnf update sudoTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, system administrators can review and restrict the permissions granted to users via the sudoers file, ensuring that only trusted users have access to execute commands with sudo. However, this is not a permanent solution and updating the package is strongly recommended.
Conclusion
The sudo package vulnerability CVE-2026-82474 poses a significant risk by allowing unauthorized command execution. It is crucial for system administrators to update their sudo packages to the latest patched version to ensure system security. Additionally, reviewing user permissions can help mitigate risks until the update is applied.
See every vulnerability recorded for sudo →
FAQ
CVE-2026-82474 is a vulnerability in the sudo package that allows unauthorized program execution due to a policy bypass.
This vulnerability can allow malicious users to execute commands that should be restricted, potentially compromising system security.
As a temporary measure, review and restrict user permissions in the sudoers file to limit access until the package can be updated.
More details can be found on the CVE page associated with CVE-2026-82474, which provides insights into the impact and mitigation strategies.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software by analyzing a manifest file like package-lock.json. You can check your application for vulnerabilities using the Vulert playground without any signup.
Related vulnerabilities
Recent vulnerabilities recorded for sudo.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
