Summary
It was discovered that Sudo did not properly handle time-based access
restrictions when sudoers rules used NOTBEFORE or NOTAFTER with
timestamps omitting the trailing timezone indicator. A local attacker
could possibly use this issue to execute commands outside the intended
time window by manipulating the TZ environment variable.
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 22.04 LTS 22.04:LTS | sudo | 1.9.9-1ubuntu2.7 |
| Ubuntu · 24.04 LTS 24.04:LTS | sudo | 1.9.15p5-3ubuntu5.24.04.4 |
| Ubuntu · 26.04 LTS 26.04:LTS | sudo | 1.9.17p2-1ubuntu3.2 |
Vulnerabilities 1
-
High 7.8CVE-2026-96512 Public exploit
Sudo: sudo: tz environment variable allows bypass of notbefore/notafter time-based authorization
A flaw was found in sudo. When sudoers rules use NOTBEFORE or NOTAFTER time-based access restrictions with timestamps that omit the trailing 'Z' timezone indicator, the time evaluation relies on the TZ environment variable inherited from the calling user. Bec…
References
-
report
https://ubuntu.com/security/CVE-2026-96512