CVE-2026-34354 Race condition in Guardicore Platform Agent
Local attackers can escalate privileges to root via TOCTOU race conditions in the IPC socket and command injection in diagnostic tools.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-34354?
CVE-2026-34354 is a high-severity vulnerability in Akamai Guardicore Platform Agent, published on 8 May 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Akamai Guardicore Platform Agent (GPA) and Zero Trust Client on Linux and macOS allow TOCTOU-based local privilege escalation. The GPA service creates an IPC socket in the world-writable /tmp directory. It accepts unauthenticated IPC control messages. This enables a TOCTOU vulnerability in the HandleSaveLogs() function of the GPA service, by creating a log file and manipulating it into a symlink that points to the targeted path; this can allow an unprivileged local user to make arbitrary root-owned files world-writable. In addition, a diagnostic collection tool (gimmelogs) running with root privileges was vulnerable to command injection from the dbstore, offering a second privilege escalation vector. (On Windows, gimmelogs does not have command injection but does allow writing a ZIP archive to an unintended location.) This affects Akamai Guardicore Platform Agent 7.0 through 7.3.1 and Akamai Zero Trust Client 6.0 through 6.1.5.
Weakness: CWE-367
Which versions are affected by CVE-2026-34354?
How do I fix CVE-2026-34354?
No fix has been published for CVE-2026-34354 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-34354 being exploited?
There is no known exploitation of CVE-2026-34354 in the wild and no public exploit code.
Sources
Also known as GHSA-54h8-vwcv-q5r9.