CVE-2026-96512

Sudo: sudo: tz environment variable allows bypass of notbefore/notafter time-based authorization

State: Published
Severity: 7.8 High
Published: Sep 23, 2026
Updated: Oct 29, 2026
Reserved: Sep 23, 2026

Description

A flaw was found in sudo. When sudoers rules use NOTBEFORE or NOTAFTER time-based access restrictions with timestamps that omit the trailing 'Z' timezone indicator, the time evaluation relies on the TZ environment variable inherited from the calling user. Because sudo is a setuid-root program, an unprivileged local user can set TZ to an extreme timezone offset to shift the authorization window by up to approximately 25 hours, causing expired rules to be treated as valid. This allows the user to execute commands outside the intended time window. Authentication is not bypassed; only the time-based authorization check is affected.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	redhat

Weaknesses

CWE-863 Incorrect Authorization

Affected Products

Product	Versions
Red Hat Enterprise Linux 10Red Hat	0:1.9.17-10.p2.el10_2.7 and laterNot affected
Red Hat Enterprise Linux 10.0 Extended Update SupportRed Hat	0:1.9.15-8.p5.el10_0.5 and laterNot affected
Red Hat Enterprise Linux 7 Extended Lifecycle SupportRed Hat	0:1.8.23-10.el7_9.6 and laterNot affected
Red Hat Enterprise Linux 8Red Hat	0:1.9.5p2-2.el8_10 and laterNot affected
Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update SupportRed Hat	0:1.8.29-7.el8_4.4 and laterNot affected
Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-OnRed Hat	0:1.8.29-7.el8_4.4 and laterNot affected
Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update SupportRed Hat	0:1.9.5p2-1.el8_6.4 and laterNot affected
Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-OnRed Hat	0:1.9.5p2-1.el8_6.4 and laterNot affected
Red Hat Enterprise Linux 8.8 Telecommunications Update ServiceRed Hat	0:1.9.5p2-1.el8_8.4 and laterNot affected
Red Hat Enterprise Linux 8.8 Update Services for SAP SolutionsRed Hat	0:1.9.5p2-1.el8_8.4 and laterNot affected
Red Hat Enterprise Linux 9Red Hat	0:1.9.17p2-3.el9_8.3 and laterNot affected
Red Hat Enterprise Linux 9Red Hat	0:1.9.17p2-3.el9_8.3 and laterNot affected
Red Hat Enterprise Linux 9.2 Update Services for SAP SolutionsRed Hat	0:1.9.5p2-9.el9_2.5 and laterNot affected
Red Hat Enterprise Linux 9.4 Update Services for SAP SolutionsRed Hat	0:1.9.5p2-10.el9_4.4 and laterNot affected
Red Hat Enterprise Linux 9.6 Extended Update SupportRed Hat	0:1.9.5p2-10.el9_6.4 and laterNot affected
Red Hat Hardened ImagesRed Hat	1.9.17-16.p2.2.hum1 and laterNot affected
Red Hat OpenShift AI 3.0Red Hat	1793041981 and laterNot affected
Red Hat OpenShift AI 3.4Red Hat	1793042006 and laterNot affected
Red Hat OpenShift AI 3.4Red Hat	1793041995 and laterNot affected
Red Hat Update Infrastructure 5Red Hat	1791964013 and laterNot affected
Red Hat Update Infrastructure 5Red Hat	1791978693 and laterNot affected

References

RHSA-2026:71609vendor-advisory
RHSA-2026:75571vendor-advisory
RHSA-2026:75579vendor-advisory
RHSA-2026:75580vendor-advisory
RHSA-2026:82939vendor-advisory
RHSA-2026:86633vendor-advisory
RHSA-2026:86634vendor-advisory
RHSA-2026:86635vendor-advisory
RHSA-2026:87026vendor-advisory
RHSA-2026:90287vendor-advisory
RHSA-2026:91217vendor-advisory
RHSA-2026:91219vendor-advisory
RHSA-2026:91244vendor-advisory
RHSA-2026:92325vendor-advisory
RHSA-2026:92326vendor-advisory
RHSA-2026:92349vendor-advisory
https://access.redhat.com/security/cve/CVE-2026-96512vdb-entry
RHBZ#2539327issue-tracking
https://github.com/sudo-project/sudo/commit/1820a349687522f51023d1ae5925125f59679a8c
http://www.openwall.com/lists/oss-security/2026/09/24/4

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.