Critical Security Flaw in sudo Package: TZ Environment Variable Bypass
Summary
ALSA-2026:75571: Important: sudo security update. Affects sudo versions < 1.9.17p2-3.el9_8.3. Fixed in 1.9.17p2-3.el9_8.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The sudo package is a widely used utility that allows system administrators to grant specific users the ability to execute privileged commands without requiring root access. This functionality is crucial for system management, enabling secure and controlled access to administrative tasks. However, the sudo package has been found to have a vulnerability related to the TZ environment variable, which can potentially allow unauthorized users to bypass time-based authorization restrictions.
Vulnerability Detail
The vulnerability identified as CVE-2026-96512 allows attackers to exploit the TZ environment variable to bypass the NOTBEFORE/NOTAFTER time-based authorization checks implemented in the sudo utility. This could lead to unauthorized execution of privileged commands, compromising system security and integrity. The flaw arises from improper handling of the TZ variable, which can be manipulated to circumvent the intended access controls.
How To Fix
Minimum fixed version
1.9.17p2-3.el9_8.3
This is the first release that contains the fix.
sudo dnf update sudoTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, system administrators can restrict the use of the TZ environment variable for users who have access to the sudo command. This can be done by modifying the sudoers file to unset the TZ variable for specific users or groups. For example, add the following line to the sudoers file: 'Defaults !env_reset, env_keep += "TZ"'. However, this is not a permanent solution and updating the package is strongly recommended.
Conclusion
The sudo package vulnerability CVE-2026-96512 poses a significant risk by allowing unauthorized command execution through the manipulation of the TZ environment variable. It is crucial for system administrators to update their sudo packages to the latest version to ensure system security. Monitoring tools like Vulert can assist in identifying and managing such vulnerabilities effectively.
See every vulnerability recorded for sudo →
FAQ
CVE-2026-96512 is a security flaw in the sudo package that allows the TZ environment variable to bypass time-based authorization checks, potentially enabling unauthorized command execution.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The risks include unauthorized access to privileged commands, which can lead to system compromise, data breaches, and loss of integrity.
Update the sudo package to the latest patched version (1.9.17p2-3.el9_8.3 or later) to mitigate the vulnerability. Additionally, consider implementing temporary workarounds to restrict the TZ variable.
Yes, using tools like Vulert, which monitors and alerts for open-source vulnerabilities in real-time based on your manifest file, can help keep your software secure.
Related vulnerabilities
Recent vulnerabilities recorded for sudo.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
