CVE-2026-96512 in Red Hat
Summary
by MITRE • 09/23/2026
A flaw was found in sudo. When sudoers rules use NOTBEFORE or NOTAFTER time-based access restrictions with timestamps that omit the trailing 'Z' timezone indicator, the time evaluation relies on the TZ environment variable inherited from the calling user. Because sudo is a setuid-root program, an unprivileged local user can set TZ to an extreme timezone offset to shift the authorization window by up to approximately 25 hours, causing expired rules to be treated as valid. This allows the user to execute commands outside the intended time window. Authentication is not bypassed; only the time-based authorization check is affected.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/23/2026
The vulnerability identified in sudo involves a critical flaw in how the application processes time-based access restrictions defined within the sudoers configuration file. Specifically, this issue affects rules that utilize NOTBEFORE or NOTAFTER directives to enforce temporal boundaries on command execution privileges. These directives are designed to restrict when specific users or groups can execute certain commands based on system time. The core technical flaw arises from the handling of timestamp formats that lack a trailing 'Z' character, which is the standard indicator for Coordinated Universal Time (UTC) in ISO 8601 format. When such timestamps are encountered without this explicit timezone designator, sudo defaults to interpreting them relative to the TZ environment variable inherited from the calling user's session rather than enforcing a strict UTC interpretation as intended by the system administrator.
This behavior creates a significant security gap because sudo operates with setuid-root privileges, meaning it runs with elevated permissions regardless of the invoking user's identity. An unprivileged local attacker can exploit this logic error by manipulating their environment variables before executing sudo commands. By setting the TZ variable to an extreme timezone offset, such as those found in regions far east or west of UTC, the attacker effectively shifts the perceived system time used for authorization checks. This manipulation allows the user to alter the calculated current time by up to approximately twenty-five hours relative to the actual server time. Consequently, commands that should be denied due to being outside their authorized window are incorrectly evaluated as valid because the shifted time falls within the permitted range defined in the sudoers rules.
The operational impact of this vulnerability is primarily related to authorization bypass rather than authentication bypass. The attacker does not gain access by circumventing password prompts or credential validation; instead, they exploit a logic error in the post-authentication privilege escalation phase. This means that any user with valid credentials for a sudo rule containing time-based restrictions can potentially execute commands outside of those intended constraints. For organizations relying on strict temporal controls to limit administrative actions during specific maintenance windows or to enforce compliance policies regarding when privileged operations can occur, this flaw undermines the integrity of those security measures. The ability to shift the authorization window by nearly a full day represents a substantial deviation from expected policy enforcement and could lead to unauthorized changes occurring at inappropriate times.
From a classification perspective, this vulnerability aligns with CWE-20 Improper Input Validation, as sudo fails to correctly validate or normalize timezone information in timestamp strings before performing logical comparisons. It also relates to CWE-613 Insufficient Session Expiration, although the context is specific to time-based access control rather than session duration. In terms of offensive security frameworks like MITRE ATT&CK, this flaw facilitates Privilege Escalation through a logic error that allows an attacker to bypass intended restrictions on command execution timing. This falls under techniques involving environment variable manipulation and exploitation of setuid binaries for lateral movement or persistent access if the time window is critical for maintaining stealth during specific operational hours.
Mitigation strategies must address both immediate remediation and long-term configuration hardening. The primary solution is to update sudo to a version that includes patches correcting this timezone parsing logic, ensuring that timestamps without explicit 'Z' indicators are treated as UTC by default or rejected outright if the format is ambiguous. System administrators should audit their sudoers files for any NOTBEFORE or NOTAFTER rules and ensure they use fully compliant ISO 8601 timestamp formats including the trailing Z character to eliminate ambiguity. Additionally, restricting the ability of users to modify environment variables such as TZ in untrusted contexts can reduce the attack surface. Implementing strict input validation on all time-related inputs within privileged applications is a broader best practice that prevents similar logic errors from being exploited in other software components. Regular vulnerability scanning and configuration reviews are essential to maintain the integrity of access control policies against evolving exploitation techniques.