CVE-2026-123039: Local privilege escalation to root in the DynamicCLI daemon via local world-writable control socket
The Gaia OS DynamicCLI daemon runs as root and listens on a world-writable local socket (/tmp/dynamicsocket) without authenticating connecting processes. An authenticated local user can send a command to the socket and have it executed as root.
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated local user who can connect to the local control socket can exploit it. Remote-only attackers are not indicated by the provided data.
What access or conditions does an attacker need?
The attacker needs local authenticated access to the affected system and the ability to send commands to /tmp/dynamic_socket. No additional authentication by the DynamicCLI daemon is required for connecting processes.
What is the impact of successful exploitation?
Commands sent through the socket are executed by the DynamicCLI daemon as root. This allows the local user to escalate privileges to root and can affect confidentiality, integrity, and availability.
How can I identify an exposed system?
Check whether the DynamicCLI daemon is running as root and listening on /tmp/dynamic_socket with world-writable permissions. A world-writable socket at that path allows unauthenticated local processes to submit commands.