Sudo CVE-2026-96512 (CVSS 7.8): TZ env bypass of NOTBEFORE/NOTAFTER — fix in main; RHSA-2026:71609

CVE-2026-96512 (Red Hat CNA; published 23 September 2026; oss-security disclosure 24 Sep) is a high-severity incorrect-authorization flaw in Sudo: when sudoers uses NOTBEFORE/NOTAFTER timestamps that omit a trailing Z, parse_gentime() calls mktime() which re-reads the caller’s TZ. A local user who already has such a time-bound sudoers rule can set an extreme POSIX TZ offset (e.g. TZ=XXX24) and shift the authorization window by ~25 hours, keeping an expired rule valid or unlocking a future rule early. Authentication/PAM is not bypassed. Affected: Sudo 1.8.20 through 1.9.17p2 (and main before the fix). Reporter Ermenson Junior (28 Aug); Todd Miller fixed in main 29 Aug (commit 1820a349); no upstream 1.9.18 release yet at disclosure. Red Hat rates Important; ships RHSA-2026:71609. Workaround: append Z (UTC) to all NOTBEFORE/NOTAFTER timestamps. Primary: Red Hat CVE; secondary: oss-security; wire: Cyber Security News 25 Sep.

Product

Sudo (sudoers time-based authorization)

Versions

Affected: 1.8.20 through 1.9.17p2 (and main before fix commit 1820a349). Upstream release with fix not yet cut at disclosure; apply distro errata (e.g. RHSA-2026:71609) or rebuild from fixed main.

CVSS

7.8

Exploited in Australia?

unknown

Patch to

Apply vendor/distro sudo updates when available; until then append Z to every NOTBEFORE/NOTAFTER timestamp (UTC via timegm) and audit with grep -rE 'NOT(BEFORE|AFTER)=' /etc/sudoers /etc/sudoers.d/. Default configs without time windows are unaffected.

Primary: Red Hat — CVE-2026-96512 (sudo TZ / NOTBEFORE|NOTAFTER) · Vendor: Red Hat RHSA-2026:71609 · CVE: CVE-2026-96512 · oss-security — Ermenson Junior disclosure (24 Sep 2026)

vulnerabilities identity