CVE-2026-96512

Awaiting Analysis Awaiting Analysis - Queue

Time-Based Authorization Bypass in Sudo

Publication date: 2026-09-23

Last updated on: 2026-09-24

Assigner: redhat-SADP

Description

A flaw was found in sudo. When sudoers rules use NOTBEFORE or NOTAFTER time-based access restrictions with timestamps that omit the trailing 'Z' timezone indicator, the time evaluation relies on the TZ environment variable inherited from the calling user. Because sudo is a setuid-root program, an unprivileged local user can set TZ to an extreme timezone offset to shift the authorization window by up to approximately 25 hours, causing expired rules to be treated as valid. This allows the user to execute commands outside the intended time window. Authentication is not bypassed; only the time-based authorization check is affected.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-23

Last Modified

2026-09-24

Generated

2026-09-24

AI Q&A

2026-09-23

EPSS Evaluated

N/A

NVD

CVE-2026-96512

EUVD

EUVD-2026-85290

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

Executive Summary

This vulnerability in sudo involves time-based access restrictions using NOTBEFORE or NOTAFTER rules without the trailing 'Z' timezone indicator. Because sudo relies on the TZ environment variable, a local unprivileged user can manipulate it to shift the authorization window by up to 25 hours. This makes expired rules appear valid, allowing command execution outside intended time windows. Authentication is not bypassed, only the time-based check is affected.

Detection Guidance

To detect this vulnerability, audit sudoers rules for NOTBEFORE or NOTAFTER timestamps lacking the trailing 'Z' timezone indicator. Use the command: grep -rE 'NOTBEFORE|NOTAFTER' /etc/sudoers /etc/sudoers.d/ | grep -v 'Z$'.

Impact Analysis

If you are an administrator using sudoers rules with NOTBEFORE or NOTAFTER timestamps lacking the 'Z' suffix, an attacker with local access could execute privileged commands outside the intended time window. This could lead to unauthorized actions during restricted periods, but only within the permissions already granted by the sudoers rule.

Compliance Impact

This vulnerability could impact compliance by allowing unauthorized privileged actions during restricted time windows, potentially violating access control policies required by GDPR, HIPAA, or other regulations. Organizations using sudoers time-based restrictions without the 'Z' suffix may face audit failures or increased risk of non-compliance due to weakened access controls.

Mitigation Strategies

Immediately append 'Z' to all NOTBEFORE and NOTAFTER timestamps in sudoers rules to ensure UTC interpretation. Example: Change 'NOTBEFORE=2026-01-01 12:00' to 'NOTBEFORE=2026-01-01 12:00Z'.

Hi! I’m here to help you understand CVE-2026-96512. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70