sudo NOTBEFORE/NOTAFTER Time Window Enforcement Reads the TZ Environment Variable, Allowing Low-Privileged Users to Shift the Clock and Bypass Scheduling Constraints
Last refreshed2026-10-30
Status: UPDATED
| Advisory ID: CVE-2026-96512
Key Details
CVE
CVE-2026-96512
CVSS Score / Version
7.8 (High) / CVSS v3.1
Updated
2026-10-29
CVSS Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS Prose
attack vector is local; attack complexity is low; privileges required is low; user interaction is none; scope is unchanged; confidentiality impact is high; integrity impact is high; availability impact is high.
Affected products
see table below
Classified as
CWE-863 (Incorrect Authorization)
Exploitation prediction (EPSS)
0.14% probability of exploitation in the next 30 days (3% percentile) -- FIRST.org's EPSS model.
Affected Products, Subsystems & Sectors
Vendor
Product
Affected Versions
Patch Status
Red Hat
Red Hat Enterprise Linux 10
Red Hat
Red Hat Enterprise Linux 8
Red Hat
Red Hat Enterprise Linux 9
Red Hat
Red Hat Enterprise Linux 7
Red Hat
Red Hat Update Infrastructure 5
Red Hat
Red Hat Hardened Images
Subsystems
OT Supporting Infrastructure
Sectors
Multiple
What to Know
A flaw was found in sudo. When sudoers rules use NOTBEFORE or NOTAFTER time-based access restrictions with timestamps that omit the trailing 'Z' timezone indicator, the time evaluation relies on the TZ environment variable inherited from the calling user. Because sudo is a setuid-root program, an unprivileged local user can set TZ to an extreme timezone offset to shift the authorization window by up to approximately 25 hours, causing expired rules to be treated as valid. This allows the user to execute commands outside the intended time window. Authentication is not bypassed; only the time-based authorization check is affected. (NVD)
What to Do
Monitor Red Hat's web page for any future patch releases.