Local Privilege Escalation in Akamai Guardicore Platform Agent and Zero Trust Client

CVE-2026-34354

What is CVE-2026-34354?

The Akamai Guardicore Platform Agent and Zero Trust Client on Linux and macOS present a vulnerability allowing local privilege escalation through a TOCTOU (Time of Check to Time of Use) flaw. This issue arises from the GPA service's creation of an IPC socket in a world-writable /tmp directory and its acceptance of unauthenticated IPC control messages. Specifically, the HandleSaveLogs() function is affected, enabling a local user to create a log file and exploit it by establishing a symlink to a targeted path, thus making arbitrary root-owned files world-writable. Additionally, the gimmelogs tool, which operates with root privileges, is susceptible to command injection via the dbstore, providing an alternative path for privilege escalation. This vulnerability affects specific versions of the Guardicore Platform Agent and Zero Trust Client, necessitating timely remediation.

References