Sudo Vulnerability Allows Local Privilege Escalation by Manipulating Time Restrictions
A critical vulnerability in Sudo, CVE-2026-96512, allows local attackers to bypass time-based access controls by manipulating the TZ environment variable, enabling unauthorized command execution.
A high-severity security vulnerability, tracked as CVE-2026-96512, has been discovered in the widely-used Sudo utility, potentially allowing local attackers to escalate privileges by bypassing time-based access restrictions. The flaw affects Sudo versions ranging from 1.8.20 through 1.9.17p2 and exploits an unsafe handling of the TZ environment variable.
Sudo, a fundamental tool on Linux and Unix-like systems, grants authorized users the ability to execute commands with the privileges of another user, most commonly the root user. Administrators leverage sudoers rules to enforce granular control over command execution, including time-based limitations such as NOTBEFORE and NOTAFTER conditions. These rules are designed to restrict access to specific command windows, ensuring that sensitive operations are only performed within permitted timeframes.
The vulnerability arises from Sudo's parse_gentime() function, which relies on mktime() and the system's TZ environment variable to process timestamps. Crucially, it does not explicitly handle timezones during this process. When Sudo, as a setuid-root program, inherits the invoking user's environment, a local attacker can craft a specially manipulated timezone value. By setting an extreme POSIX timezone offset, such as TZ=XXX24, an attacker can effectively shift Sudo's interpretation of authorization times by approximately 25 hours in either direction.
This manipulation can lead to a critical security bypass. For instance, a NOTAFTER rule that has expired might be misinterpreted as still active, or a NOTBEFORE rule could be used before its intended start time. This effectively undermines the intended time-based access controls configured by administrators. It is important to note that this vulnerability does not bypass password authentication or Pluggable Authentication Modules (PAM); an attacker must already be an authenticated local user with existing Sudo privileges that rely on these affected time-based restrictions.
Independent security researcher Ermenson Junior reported the issue on August 28, 2026. The vulnerability was committed to the Sudo project's main branch by upstream maintainer Todd Miller on August 29, 2026. The fix involves preventing the user-controlled TZ variable from influencing Sudo's timezone settings during critical timestamp processing, thereby mitigating the risk of repeated calls to mktime() using an attacker-provided timezone.
At the time of disclosure, the fix had not yet been incorporated into a released version of Sudo. Organizations running vulnerable versions of Sudo (1.8.20 through 1.9.17p2) are advised to review their sudoers policies for any time-based restrictions (NOTBEFORE/NOTAFTER). Applying vendor-provided updates once they become available is crucial. Additionally, administrators should consider using explicit UTC timestamps or timezone offsets in their time-bound authorization rules to minimize ambiguity and enhance security.
This vulnerability highlights the ongoing challenges in securing privileged access management, especially when complex configurations like time-based restrictions are employed. The reliance on environment variables and the intricacies of time parsing in system utilities can introduce subtle yet critical security flaws. As systems become more complex, thorough auditing and prompt patching remain paramount for maintaining a robust security posture.