Critical Privilege Escalation Vulnerability in Sudo Package
Summary
RLSA-2026:10758: Important: sudo security update. Affects sudo versions < 0:1.9.15-10.p5.el10_1. Fixed in 0:1.9.15-10.p5.el10_1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Sudo package is a widely used utility that allows system administrators to grant specific users the ability to execute commands with elevated privileges, without requiring them to log in as the root user. This functionality is crucial for system management, enabling secure and controlled access to sensitive system operations. However, vulnerabilities in Sudo can lead to severe security risks, including unauthorized access and privilege escalation.
Vulnerability Detail
The vulnerability identified as CVE-2026-35535 is a critical privilege escalation flaw in the Sudo utility. It arises from a failure in privilege drop calls, which can allow an attacker to gain elevated privileges on the system. This can lead to unauthorized access to sensitive data and system control, potentially compromising the entire system. The CVSS score for this vulnerability is 7.4, indicating a high severity level.
How To Fix
Minimum fixed version
0:1.9.15-10.p5.el10_1
This is the first release that contains the fix.
sudo dnf update sudoTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, system administrators can limit the use of Sudo for users who do not require elevated privileges until the package is updated. Additionally, monitoring user activities and implementing strict access controls can help mitigate the risk.
Conclusion
The identified vulnerability in the Sudo package poses a significant risk to system security, allowing for potential privilege escalation. It is crucial to update to the latest patched version to mitigate this risk. Additionally, utilizing tools like Vulert can help in monitoring and managing open-source vulnerabilities effectively.
See every vulnerability recorded for sudo →
FAQ
The impact includes potential unauthorized access and privilege escalation, which can compromise system security.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected.
Implement strict access controls and limit Sudo usage for users who do not need elevated privileges as a temporary measure.
Yes, Vulert provides a solution that uses a manifest file to monitor vulnerabilities in real-time without requiring code access or installation.
The CVSS score for this vulnerability is 7.4, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for sudo.
