Critical Privilege Escalation Vulnerability in sudo Package: CVE-2026-35535
Summary
ALSA-2026:19067: Important: sudo security update. Affects sudo versions < 1.9.17-4.p2.el10_2. Fixed in 1.9.17-4.p2.el10_2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The sudo package is a widely used utility that allows system administrators to grant specific users the ability to execute commands with elevated privileges without needing to log in as the root user. This functionality is crucial for system management and security, enabling controlled access to sensitive operations. However, the sudo package has been found to have a vulnerability that could allow unauthorized privilege escalation, posing significant security risks to systems relying on this utility.
Vulnerability Detail
The vulnerability identified as CVE-2026-35535 arises from a failure in the privilege drop calls within the sudo utility. This flaw can be exploited by attackers to escalate their privileges, potentially allowing them to execute arbitrary commands with elevated rights. The ramifications of this vulnerability are severe, as it compromises the integrity of the system and could lead to unauthorized access to sensitive data or system control.
How To Fix
Minimum fixed version
1.9.17-4.p2.el10_2
This is the first release that contains the fix.
sudo dnf update sudoTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, system administrators can limit the use of the sudo command for affected users until the package is updated. This can be done by modifying the sudoers file to restrict access to specific commands or users.
Conclusion
The sudo package vulnerability CVE-2026-35535 poses a significant risk of privilege escalation, allowing unauthorized users to execute commands with elevated privileges. It is crucial for system administrators to update to the patched version of the sudo package to safeguard their systems against potential exploitation.
See every vulnerability recorded for sudo →
FAQ
CVE-2026-35535 is a vulnerability in the sudo package that allows privilege escalation due to a failure in privilege drop calls.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities. Visit Vulert Scanner to check if your application is affected without needing to sign up.
The risks include unauthorized access to system commands and potential control over sensitive data, which can lead to severe security breaches.
You can update the sudo package by running 'sudo yum update sudo' in your terminal, ensuring you install version 1.9.17-4.p2.el10_2 or later.
Yes, you can restrict the use of the sudo command for affected users by modifying the sudoers file to limit access to specific commands.
Related vulnerabilities
Recent vulnerabilities recorded for sudo.
