CVE-2026-96512: Sudo: sudo: tz environment variable allows bypass of notbefore/notafter time-based authorization
A flaw was found in sudo. When sudoers rules use NOTBEFORE or NOTAFTER time-based access restrictions with timestamps that omit the trailing 'Z' timezone indicator, the time evaluation relies on the TZ environment variable inherited from the calling user. Because sudo is a setuid-root program, an unprivileged local user can set TZ to an extreme timezone offset to shift the authorization window by up to approximately 25 hours, causing expired rules to be treated as valid. This allows the user to execute commands outside the intended time window. Authentication is not bypassed; only the time-based authorization check is affected.
Other sources
A flaw was found in sudo's handling of NOTBEFORE and NOTAFTER time-based authorization in sudoers rules. The parsegentime() function in plugins/sudoers/gentime.c uses mktime() to interpret timestamps that lack a timezone suffix (no trailing 'Z' or explicit UTC offset). Because mktime() converts based on the process's TZ environment variable, and sudo is a setuid-root program that inherits the caller's environment, an unprivileged user can set TZ to an extreme POSIX timezone offset (e.g., TZ=XXX24) to shift the time evaluation window by up to ~25 hours in either direction. This allows expired NOTAFTER rules to appear valid, or not-yet-active NOTBEFORE rules to become usable. Authentication (PAM) is NOT bypassed; only the time-based authorization decision is affected.
The feature was introduced in sudo 1.8.20. All versions from 1.8.20 through 1.9.17p2 are affected. The fix was committed to upstream main by Todd Miller on 2026-08-29 (commit 1820a349687522f51023d1ae5925125f59679a8c) but sudo 1.9.18 has not been released.
Reported by Ermenson Junior (independent security researcher) on 2026-08-28. PSIRT Ticket: PSIRTSUPT-24357
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
sudoto a version that resolves this vulnerability.Patch 1820a349687522f51023d1ae5925125f59679a8c
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems are exposed where sudoers rules use NOTBEFORE or NOTAFTER restrictions with timestamps that do not include a trailing Z or an explicit UTC offset. The issue affects local users whose sudo authorization is limited by such a time-based rule.
What does an attacker need to exploit it?
An attacker needs local access and an applicable sudoers rule that grants them command access subject to the affected time restriction. They can set the TZ environment variable to an extreme timezone offset; sudo authentication is still required and is not bypassed.
How can administrators identify potentially affected rules?
Review sudoers policy for NOTBEFORE and NOTAFTER timestamps. Rules whose timestamps omit both a trailing Z and an explicit timezone offset are potentially affected.
What can be done before an update is available?
Update affected sudoers time restrictions to use timestamps with a trailing Z or an explicit UTC offset. This prevents their interpretation from depending on the calling user's TZ environment variable.