Critical Sudo Vulnerability (CVE-2021-3156) Lets Attackers Gain Root Privileges

Key Takeaways

• A high-severity vulnerability, CVE-2026-96512, impacts Sudo versions 1.8.20 through 1.9.17p2.
• The flaw allows local authenticated users to bypass time-based access restrictions in Sudo by manipulating the TZ environment variable.
• This could enable privilege escalation beyond defined schedules, particularly where temporary access windows are employed.
• A fix has been committed by the Sudo project, and administrators are advised to apply updates once released by their vendors.

Sudo Vulnerability Allows Time-Based Privilege Escalation

A significant security flaw has been identified in Sudo, the ubiquitous Linux utility, enabling local attackers to circumvent time-dependent access controls and execute commands with elevated privileges. This high-severity vulnerability, tracked as CVE-2026-96512, specifically targets Sudo versions ranging from 1.8.20 up to and including 1.9.17p2.

The core of the issue lies in Sudo’s insecure handling of the TZ environment variable. Sudo, a critical component in Linux environments, empowers authorized users to run commands as another user, typically the root superuser. System administrators frequently employ sudoers rules to impose strict limitations on when privileged commands can be executed, often utilizing NOTBEFORE and NOTAFTER conditions to define specific access windows.

Technical Details of CVE-2026-96512

The vulnerability permits unprivileged local users to subvert these time-based restrictions. This occurs because Sudo’s internal parse_gentime() function, responsible for processing timestamps, relies on mktime() without explicitly defined timezones. Consequently, mktime() defaults to using the TZ environment variable for timezone information.

Given that Sudo operates as a setuid-root program, it initially inherits the calling user’s environment. An attacker can exploit this by defining a specially crafted TZ value before initiating a Sudo command. For instance, an extreme POSIX timezone offset, such as TZ=XXX24, can artificially shift Sudo’s interpretation of the authorization time by approximately 25 hours in either direction. This manipulation could effectively invalidate an active NOTAFTER rule, making it appear expired, or prematurely enable a NOTBEFORE rule.

It is important to note that this flaw does not bypass password authentication or Pluggable Authentication Modules (PAM). An attacker must first be an authenticated local user and possess an existing Sudo rule that incorporates the vulnerable time-based restrictions. However, in scenarios where administrators implement time windows to grant temporary access to sensitive commands, this bug critically undermines that security control, enabling privilege escalation beyond the intended schedule. The affected time-based authorization feature was initially introduced in Sudo version 1.8.20.

Red Hat’s vulnerability record lists the issue as high severity, highlighting that Linux systems running vulnerable Sudo versions are exposed when NOTBEFORE or NOTAFTER conditions are configured without explicit timezone information. Independent security researcher Ermenson Junior first reported this vulnerability on August 28, 2026.

Patch and Mitigation

In response to the discovery, upstream Sudo maintainer Todd Miller committed a fix to the project’s main branch on August 29, 2026. The patch addresses the vulnerability by removing the user-controlled TZ variable from Sudo’s working environment when setting the timezone. This prevents repeated calls to mktime() from utilizing an attacker-supplied timezone. At the time of this disclosure, the fix had not yet been integrated into a released Sudo 1.9.18 version.

What You Should Do

• Immediately identify all systems running Sudo versions 1.8.20 through 1.9.17p2.
• Review your sudoers policies for any reliance on NOTBEFORE and NOTAFTER entries, particularly those configured without explicit timezone information.
• Apply vendor-provided updates for Sudo as soon as they become available.
• As an immediate mitigation, consider using explicit UTC timestamps or timezone offsets in all time-bound authorization rules within your sudoers file to reduce ambiguity in time calculations.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.