CVE-2026-34354: Command Injection
Akamai Guardicore Platform Agent (GPA) and Zero Trust Client on Linux and macOS allow TOCTOU-based local privilege escalation. The GPA service creates an IPC socket in the world-writable /tmp directory. It accepts unauthenticated IPC control messages. This enables a TOCTOU vulnerability in the HandleSaveLogs() function of the GPA service, by creating a log file and manipulating it into a symlink that points to the targeted path; this can allow an unprivileged local user to make arbitrary root-owned files world-writable. In addition, a diagnostic collection tool (gimmelogs) running with root privileges was vulnerable to command injection from the dbstore, offering a second privilege escalation vector. (On Windows, gimmelogs does not have command injection but does allow writing a ZIP archive to an unintended location.) This affects Akamai Guardicore Platform Agent 7.0 through 7.3.1 and Akamai Zero Trust Client 6.0 through 6.1.5.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-34354?
The severity of CVE-2026-34354 is rated as high with a score of 7.4.
How do I fix CVE-2026-34354?
To fix CVE-2026-34354, ensure that the IPC socket is created in a secure directory and properly restrict access to prevent unauthenticated control messages.
What systems are affected by CVE-2026-34354?
CVE-2026-34354 affects the Akamai Guardicore Platform Agent and the Akamai Zero Trust Client on Linux and macOS.
What type of vulnerability is CVE-2026-34354?
CVE-2026-34354 is a TOCTOU (Time of Check to Time of Use) local privilege escalation vulnerability.
Can CVE-2026-34354 lead to complete system compromise?
Yes, CVE-2026-34354 can potentially lead to complete system compromise if exploited successfully.