CVE-2026-35535: 
NixOS vulnerability analysis and mitigation

CVE-2026-35535 is a privilege escalation vulnerability in Sudo through version 1.9.17p2, where a failure of setuid(), setgid(), or setgroups() calls during a privilege drop before running the mailer is not treated as a fatal error. This flaw allows a local attacker to potentially retain elevated (root) privileges when Sudo executes the mailer program. Affected versions include all Sudo releases up to and including 1.9.17p2 (before commit 3e474c2); Siemens SINEC OS and RUGGEDCOM RST2428P firmware prior to version 4.0 are also affected. The vulnerability was published on April 3, 2026, and was originally discovered by the ZeroPath AI Security Engineer in November 2025. It carries a CVSS v3.1 base score of 7.8 (High) per NVD, and 7.4 (High) per ENISA/GitHub Advisory (Github Advisory, Red Hat Bugzilla).

The root cause is classified under CWE-271 (Privilege Dropping / Lowering Errors) and CWE-272 (Least Privilege Violation). In Sudo's exec_mailer() function within lib/eventlog/eventlog.c, when Sudo prepares to send an alert email to the administrator, it attempts to drop privileges by calling setuid(), setgid(), and setgroups(). Prior to the fix, failures of these calls were not fatal — execution continued even if the privilege drop failed, meaning the mailer could be executed with retained root privileges. The Qualys CrackArmor advisory demonstrated that this flaw becomes exploitable when combined with an AppArmor profile that denies CAP_SETUID to Sudo: the setuid() call to drop to the unprivileged user's UID fails silently, and Sudo then executes the mailer (e.g., Postfix's /usr/sbin/sendmail) as root with attacker-controlled environment variables such as MAIL_CONFIG (Qualys Advisory, Sudo Commit).

Successful exploitation allows a local attacker to escalate privileges to full root on the affected system. If the privilege drop fails and the mailer executes as root with attacker-controlled environment variables (e.g., MAIL_CONFIG pointing to a malicious Postfix configuration), the attacker can execute arbitrary commands as root. This results in complete compromise of confidentiality, integrity, and availability of the affected host, and may enable lateral movement within a network if the compromised system has access to additional resources (Qualys Advisory, Github Advisory).

No public proof-of-concept exploit code is known to exist for CVE-2026-35535 in isolation, and there is no evidence of active in-the-wild exploitation at this time (Github Advisory). However, Qualys demonstrated a working exploit chain in their CrackArmor advisory that combines this Sudo flaw with a separate AppArmor confused-deputy vulnerability to achieve root privilege escalation on Ubuntu 24.04.3 with Postfix installed (Qualys Advisory). The EPSS score is approximately 0.004–0.006%, indicating low near-term exploitation probability. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No specific threat actor attribution has been reported.

1. Prerequisite — Obtain local access: The attacker must have a local unprivileged user account on the target system running a vulnerable Sudo version (≤1.9.17p2) with Postfix (or another mailer) installed.
2. Trigger a Sudo error condition: Cause Sudo to encounter an error that triggers the mailer (e.g., a sudoers parse error or permission failure), which causes Sudo to call exec_mailer() to send an alert email.
3. Prevent privilege drop (via AppArmor or similar): Load a custom AppArmor profile (exploiting the separate AppArmor confused-deputy vulnerability, CVE assigned separately) that denies CAP_SETUID to /usr/bin/sudo, causing the setuid() call in exec_mailer() to fail silently without aborting execution.
4. Set malicious environment variable: Before invoking Sudo, set MAIL_CONFIG=/tmp/attacker_postfix pointing to an attacker-controlled Postfix configuration directory containing a malicious postdrop script.
5. Mailer executes as root: Because the privilege drop failed non-fatally, Sudo's exec_mailer() calls execv() to run /usr/sbin/sendmail (Postfix) as root with the attacker's environment variables intact.
6. Achieve root code execution: Postfix reads the attacker-controlled MAIL_CONFIG and executes the malicious postdrop script as root, granting the attacker full root privileges (Qualys Advisory).

• Logs: Sudo log entries showing errors such as unable to change uid to <UID> or unable to change gid to <GID> in /var/log/auth.log or /var/log/sudo.log, followed immediately by mailer execution; unexpected sudoers parse error messages triggering mail alerts.
• Process: Unusual child processes of the Sudo process (e.g., /usr/sbin/sendmail, postdrop, or shell scripts) running as root (UID 0) when the invoking user is unprivileged; unexpected execution of commands from /tmp or world-writable directories by root-owned processes.
• File System: Presence of attacker-controlled Postfix configuration directories in /tmp (e.g., /tmp/postfix/main.cf, /tmp/postfix/postdrop); unexpected files created or modified by root in attacker-writable locations.
• Network: Outbound connections from the system to unexpected hosts initiated by root-owned processes spawned from Sudo's mailer execution path.
• AppArmor/Audit: AppArmor audit log entries showing a custom profile loaded for /usr/bin/sudo denying capability setuid; auditd records of setuid/setgid failures by the sudo process (Qualys Advisory).

The fix is available in Sudo commit 3e474c2f201484be83d994ae10a4e20e8c81bb69, which makes setuid(), setgid(), and setgroups() failures fatal in exec_mailer() and also ensures the group is properly set before running the mailer. Users should update Sudo to a version incorporating this commit (post-1.9.17p2). Major Linux distributions have released patched packages: Red Hat Enterprise Linux 6–10 (via multiple RHSA advisories starting RHSA-2026:10758), SUSE/openSUSE, Debian, Ubuntu, AlmaLinux, Rocky Linux, Amazon Linux 2023, and Fedora. Siemens SINEC OS and RUGGEDCOM RST2428P users should upgrade to firmware version 4.0 or later. As a temporary workaround, disabling the mailto option in sudoers (setting Defaults !mailto) prevents the mailer from being invoked, eliminating the attack surface (Sudo Commit, Red Hat Bugzilla).

Qualys published the CrackArmor advisory (dated March 10, 2026) that brought significant attention to this vulnerability by demonstrating a full exploit chain combining the Sudo flaw with AppArmor weaknesses to achieve root privilege escalation on Ubuntu 24.04.3 with Postfix. Qualys noted that the Sudo issue was independently discovered and fixed in November 2025 (commit 3e474c2) by the ZeroPath AI Security Engineer before their advisory was published. The vulnerability was discussed on the oss-security mailing list and received coverage from Linux security news outlets including LinuxSecurity.com and pro-linux.de. Red Hat, SUSE, Debian, Ubuntu, and other major distributions responded promptly with patches across multiple product lines (Qualys Advisory, oss-security).