CVE-2026-96512: The Sudo TZ Bypass That Defeats NOTBEFORE/NOTAFTER Time Restrictions, and the One-Line Fix

If your sudoers file uses time-based access windows, NOTBEFORE and NOTAFTER rules that grant a user or group elevated access only during a specific window, there is a real, narrow bypass worth patching around right now. CVE-2026-96512 lets an unprivileged local user shift how sudo evaluates those time restrictions simply by setting their own TZ environment variable, potentially treating an expired access window as still valid for up to roughly 25 hours past its actual expiration. This does not bypass authentication itself, a user still needs their normal sudo credentials, but it defeats the specific time-window control an administrator was relying on.

How the bypass actually works

Sudoers timestamps for NOTBEFORE and NOTAFTER use the Generalized Time format from RFC 4517, effectively yyyymmddHHMMSSZ, where the trailing Z indicates Coordinated Universal Time. Sudo also allows a timezone offset instead of Z, and critically, as an extension, if neither a Z nor an explicit offset is present, sudo falls back to local time to interpret the timestamp. That fallback is where the vulnerability lives: local time evaluation depends on the TZ environment variable, and TZ is an ordinary environment variable a local, unprivileged user fully controls. By setting TZ to an extreme offset before invoking sudo, a user can shift the effective evaluation of an ambiguous, non-UTC timestamp far enough to make an expired NOTAFTER window appear not yet closed, or an unopened NOTBEFORE window appear already open.

This affects Sudo versions 1.8.20 through 1.9.17p2, which covers a very large share of currently deployed Linux systems, since that version range spans years of default sudo packages across major distributions. CVSS is rated 7.8, high severity, reflecting that this is a genuine authorization control bypass even though it requires existing local access and valid sudo credentials to exploit.

The fix, and why the workaround matters right now

Upstream Sudo has a committed fix (commit 1820a349687522f51023d1ae5925125f59679a8c, authored by Sudo’s maintainer Todd Miller on August 29, 2026) that removes the TZ variable from sudo’s working environment before it evaluates timestamps, so a user-supplied timezone can no longer influence the authorization check. As of this vulnerability’s disclosure, that fix had been committed upstream but had not yet landed in a released sudo version distributions can package. That gap is exactly why the workaround below matters, patching alone is not yet available through your package manager for most distributions as of this writing, check your specific distribution’s advisory for current status before assuming you are covered.

The workaround: always specify an explicit timezone

Until a patched sudo package reaches your distribution, the fix is entirely within your control: never let a NOTBEFORE or NOTAFTER timestamp fall back to local time. Always include the trailing Z for UTC, or an explicit offset, in every time-based sudoers rule. A vulnerable rule looks like this:

# Ambiguous, relies on local time via TZ, exploitable
someuser ALL=(ALL) NOTBEFORE=20260901000000 NOTAFTER=20261001000000 ALL

The fixed version simply adds the Z:

# Explicit UTC, not affected by a user-controlled TZ value
someuser ALL=(ALL) NOTBEFORE=20260901000000Z NOTAFTER=20261001000000Z ALL

Audit every NOTBEFORE and NOTAFTER entry in your sudoers file and any files pulled in through /etc/sudoers.d/ for this exact gap. Start by listing every occurrence so you can check each one by eye:

grep -rn "NOTBEFORE\|NOTAFTER" /etc/sudoers /etc/sudoers.d/ 2>/dev/null

For each match, confirm the timestamp ends in a literal Z or an explicit numeric offset such as +0300 or -0500, not a bare digit string. Correct anything missing one, then re-verify the sudoers syntax with visudo -c before considering the fix complete.

Frequently asked questions

Does this let a user bypass sudo authentication entirely?
No. The user still needs valid sudo credentials and must already be permitted in the sudoers configuration. What this bypasses is the specific time-window restriction, a control meant to limit when that access is usable, not the underlying authorization to use sudo at all.

Do I need to wait for a patched sudo package before I am protected?
No. Adding an explicit UTC (Z) or numeric timezone offset to every NOTBEFORE and NOTAFTER timestamp in your sudoers configuration closes this specific bypass immediately, independent of which sudo version is installed, since it removes the ambiguous local-time fallback the vulnerability depends on.

Does this affect systems that do not use time-based sudoers rules at all?
No. If your sudoers configuration does not use NOTBEFORE or NOTAFTER anywhere, this specific vulnerability does not apply to you, since there is no time-based authorization check for the TZ manipulation to affect.