A sudo flaw let a permitted command escape policy checks and logging
Serguey Asael Shinder1 min readCanonical published USN-8803-1 on 22 September 2026, fixing a vulnerability in sudo. The overview is one sentence: sudo could allow a user to bypass command restrictions.
The detail is more specific. Guannan Wang, Zhanpeng Liu and Guancheng Li found a set of conditions under which the intercept checks were simply not run. Someone already cleared to invoke a particular command could, from there, start programs they had no permission for — and because the check never fired, neither did the audit entry.
Two releases are listed: Ubuntu 26.04 LTS (sudo 1.9.17p2-1ubuntu3.1) and 24.04 LTS (sudo and sudo-ldap, 1.9.15p5-3ubuntu5.24.04.3). A standard system update applies the fix.
What it means
The affected feature is the part of sudo that most deployments turn on precisely because they do not fully trust the command they are allowing. Intercept mode exists to catch what a permitted program does next — the shell escape, the child process, the editor that can run anything. A gap in it does not widen who may run sudo; it widens what those already permitted can reach.
The word to notice in the advisory is logging. A policy bypass that is recorded is an incident you find. A policy bypass that skips the log is one you do not, and the sudo log is frequently the only evidence that a privileged action happened at all on a machine with no endpoint agent.
The scope is narrow and worth stating plainly: this needs a local user who is already permitted to run something through sudo. That is not a remote exploit. It is, however, exactly the population that intercept policies were written to constrain, which is why the fix belongs in the next update window rather than the next quarter.