CVE-2026-50218: High severity Akamai Guardicore Platform Agent vulnerability
Akamai GPA (Guardicore Platform Agent) client on all platforms before 7.4 improperly validates JWT tokens used for seeding. By convincing a user to interact with a malicious link, an attacker can use a spoofed JWT token to inject arbitrary parameters into the client software, resulting in unauthorized reconfiguration and full compromise of the application's functionality. This attack can also be targeted against an already seeded client if the attacker knows the URL of the IDP that the client used for enrollment.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
Akamai Guardicore Platform Agent clients on all platforms before version 7.4 are affected. Both unseeded clients undergoing enrollment and already seeded clients can be targeted.
What does an attacker need to exploit this issue?
The attacker must convince a user to interact with a malicious link containing a spoofed JWT token. For an already seeded client, the attacker also needs to know the URL of the identity provider used when that client was enrolled.
What is the impact of successful exploitation?
A spoofed JWT can inject arbitrary parameters into the client software. This can cause unauthorized reconfiguration and full compromise of the application's functionality.
What should teams do if they cannot patch immediately?
The provided information does not specify a workaround or mitigation. Prioritize preventing users from interacting with untrusted enrollment or seeding links, particularly where an attacker may know the enrollment identity-provider URL.