Critical Security Flaw in Sudo Package: Bypass of Time-Based Authorization
Summary
ALSA-2026:75580: Important: sudo security update. Affects sudo versions < 1.9.5p2-2.el8_10. Fixed in 1.9.5p2-2.el8_10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The sudo package is a widely used utility that allows system administrators to grant specific users the ability to execute privileged commands without needing to log in as the root user. This functionality is crucial for system management and security, enabling controlled access to system resources. However, the sudo package has been identified to have a vulnerability that could potentially allow unauthorized users to bypass time-based authorization restrictions.
Vulnerability Detail
The vulnerability, identified as CVE-2026-96512, arises from the TZ environment variable, which can be manipulated to bypass the NOTBEFORE/NOTAFTER time-based authorization checks. This flaw could allow an attacker to execute privileged commands outside of the intended time restrictions, leading to unauthorized access and potential system compromise. The implications of this vulnerability are significant, as it undermines the security model of the sudo utility, which is designed to restrict access based on time-sensitive conditions.
How To Fix
Minimum fixed version
1.9.5p2-2.el8_10
This is the first release that contains the fix.
sudo dnf update sudoTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, system administrators can restrict the use of the TZ environment variable in their sudo configurations. This can be done by modifying the sudoers file to unset the TZ variable for users or commands that require strict time-based authorization.
Conclusion
The sudo package vulnerability CVE-2026-96512 poses a significant risk by allowing unauthorized bypass of time-based authorization. It is crucial for system administrators to update their sudo packages to the latest version to protect against potential exploits. Additionally, utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for sudo →
FAQ
CVE-2026-96512 is a security vulnerability in the sudo package that allows unauthorized users to bypass time-based authorization checks using the TZ environment variable.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The risks include unauthorized access to privileged commands, which could lead to system compromise and potential data breaches.
You can update the sudo package by running 'sudo dnf update sudo' in your terminal to install the latest patched version.
Yes, you can temporarily unset the TZ environment variable in your sudoers configuration to mitigate the risk until the patch is applied.
Related vulnerabilities
Recent vulnerabilities recorded for sudo.
