Vulnerability Report

CVE-2026-96512

Title: Sudo authorization bypass via TZ environment variable

Other

Proof Of Concept

PoC Available for CVE-2026-96512

CWE Category CWE-863

Published Date Sep 23, 2026

Modified Date Sep 24, 2026

Exploit Status Available

Score 7.8 CVSS v3.1

Exploit Probability (EPSS)

0.13%

Vulnerability Summary

CVE-2026-96512: A flaw was found in sudo. When sudoers rules use NOTBEFORE or NOTAFTER time-based access restrictions with timestamps that omit the trailing 'Z' timezone indicator, the time evaluation relies on the TZ environment variable inherited from the calling user. Because sudo is a setuid-root program, an unprivileged local user can set TZ to an extreme timezone offset to shift the authorization window by up to approximately 25 hours, causing expired rules to be treated as valid. This allows the user to execute commands outside the intended time window. Authentication is not bypassed; only the time-based authorization check is affected.

Impacted Vendors

Analysis in Progress...

Reference Links

https://access.redhat.com/security/cve/CVE-2026-96512 https://bugzilla.redhat.com/show_bug.cgi?id=2539327 https://github.com/sudo-project/sudo/commit/1820a349687522f51023d1ae5925125f59679a8c

CVSS v3.1

Source Entity [email protected]

Severity HIGH

7.8

Attack Vector

LOCAL

Complexity

LOW

Privileges

N/A

Interaction

NONE

Confidentiality

N/A

Integrity

N/A

Availability

N/A

Scope

UNCHANGED

RAW VECTOR CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Associated Attack Patterns (CAPEC)

Total: Patterns

CVE-2026-96512 Exploits & PoCs (Proof Of Concept)

GitHub https://github.com/Ermensonx/sudotimewarp-cve-2026-96512-

View Code

GitHub https://github.com/abraxas/CVE-2026-96512

View Code

September 24, 2026 MODIFIED