SECURITY researchers have disclosed CVE-2026-96512, a high-severity Sudo authorisation bypass with a CVSS v3 score of 7.8. The flaw affects Sudo versions 1.8.20 through 1.9.17p2, including all supported versions from Red Hat Enterprise Linux (RHEL) 7 through RHEL 10 and RHIVOS. It applies only where administrators use time-based `NOTBEFORE` or `NOTAFTER` restrictions without specifying a timezone. No exploitation has been confirmed and no public proof-of-concept code is reported.
The issue allows an unprivileged local user to manipulate the `TZ` environment variable, causing Sudo to interpret the time restriction using an extreme timezone offset. According to the advisory, this can shift the authorisation window by approximately 25 hours, allowing commands to be run outside the intended period. The bypass does not provide access beyond the privileges already granted by the user’s Sudo rule, and PAM authentication is unaffected.
Administrators should update to the patched Red Hat Hardened Images release `1.9.17-16.p2.2.hum1` where applicable. As a configuration mitigation, append a trailing `Z` to every affected timestamp so it is interpreted as UTC—for example, change `NOTAFTER=20261231235959` to `NOTAFTER=20261231235959Z`. The article says this prevents Sudo from relying on the attacker-controlled `TZ` variable.