CVE-2026-34354: Akamai Guardicore Agent LPE Vulnerability

CVE-2026-34354 Overview

CVE-2026-34354 is a local privilege escalation vulnerability affecting the Akamai Guardicore Platform Agent (GPA) and Akamai Zero Trust Client on Linux and macOS. The GPA service creates an inter-process communication (IPC) socket in the world-writable /tmp directory and accepts unauthenticated control messages. This design exposes a Time-of-Check Time-of-Use (TOCTOU) flaw in the HandleSaveLogs() function [CWE-367]. An unprivileged local user can create a log file and swap it for a symbolic link pointing at a target path, causing the root-privileged service to make arbitrary files world-writable. A second escalation vector exists through command injection in the gimmelogs diagnostic tool via the dbstore parameter.

Critical Impact
Local attackers can gain root-equivalent access by abusing the GPA service to make arbitrary system files world-writable or by injecting commands into the root-privileged gimmelogs utility.

Affected Products

Akamai Guardicore Platform Agent (GPA) versions 7.0 through 7.3.1 on Linux and macOS
Akamai Zero Trust Client versions 6.0 through 6.1.5 on Linux and macOS
Windows builds of gimmelogs (limited impact: ZIP archive write to unintended location)

Discovery Timeline

2026-05-08 - CVE-2026-34354 published to NVD
2026-05-12 - Last updated in NVD database

Technical Details for CVE-2026-34354

Vulnerability Analysis

The Guardicore Platform Agent runs as a privileged service and exposes an IPC socket within the world-writable /tmp directory. The socket accepts control messages without authenticating the caller. Any local user can therefore issue commands to the root-privileged service. The HandleSaveLogs() handler writes log data to a path the caller influences, opening a race window between path validation and file write.

An attacker creates a regular log file, then replaces it with a symlink before the service writes to it. The service follows the symlink and applies world-writable permissions to the target file. Attackers can target files such as /etc/shadow, /etc/sudoers, or root-owned binaries to obtain full system control.

The second vector resides in gimmelogs, a diagnostic collection utility that runs as root. The dbstore input is concatenated into a shell command without sanitization, enabling command injection and direct root code execution. On Windows, gimmelogs does not expose command injection but does permit writing a ZIP archive to an attacker-controlled location.

Root Cause

The root cause is a TOCTOU race condition combined with insecure IPC design [CWE-367]. The GPA service places its control socket in a shared, world-writable directory and trusts unauthenticated messages. The HandleSaveLogs() function does not atomically open and validate the target file, allowing symlink substitution between check and use.

Attack Vector

Exploitation requires local access on a Linux or macOS host running a vulnerable GPA or Zero Trust Client build. The attacker connects to the IPC socket in /tmp, sends a crafted save-logs message, and wins the race by replacing the created log file with a symlink to a sensitive root-owned path. Alternatively, the attacker injects shell metacharacters into the dbstore parameter consumed by gimmelogs to execute commands as root. Refer to the Akamai Advisory for CVE-2026-34354 for technical details.

Detection Methods for CVE-2026-34354

Indicators of Compromise

Unexpected symbolic links created under /tmp by non-root users immediately followed by GPA log-save activity
World-writable permissions on root-owned files such as /etc/shadow, /etc/sudoers, or files under /etc/cron.d/
Execution of gimmelogs with dbstore arguments containing shell metacharacters (;, |, `, $(...))
New or modified setuid binaries appearing after GPA service activity

Detection Strategies

Monitor process execution and command-line arguments for gimmelogs invocations containing shell metacharacters in dbstore parameters
Audit chmod and permission-change events on sensitive root-owned files initiated by the GPA service
Track symlink creation in /tmp by unprivileged users followed by IPC connections to the GPA socket

Monitoring Recommendations

Enable Linux audit rules (auditd) on /etc/shadow, /etc/sudoers, and /etc/passwd to log permission changes
Log all connections to GPA IPC sockets under /tmp and correlate with the connecting user identity
Alert on any root-owned file transitioning to mode 0666 or 0777 outside of approved maintenance windows

How to Mitigate CVE-2026-34354

Immediate Actions Required

Upgrade Akamai Guardicore Platform Agent to a version newer than 7.3.1 on all Linux and macOS hosts
Upgrade Akamai Zero Trust Client to a version newer than 6.1.5 on all Linux and macOS hosts
Inventory all endpoints running affected agent versions and prioritize multi-user and internet-facing systems
Review audit logs for prior exploitation indicators before patching

Patch Information

Akamai has published guidance in the Akamai Advisory for CVE-2026-34354. Administrators should apply the vendor-supplied fixed releases for both the Guardicore Platform Agent and Zero Trust Client product lines.

Workarounds

Restrict local shell access on affected hosts to trusted administrators until patches are applied
Apply strict file integrity monitoring to /etc/shadow, /etc/sudoers, and other root-owned configuration files
Disable or restrict execution of the gimmelogs diagnostic tool where operationally feasible

bash

# Verify installed agent version and check for world-writable sensitive files
rpm -q guardicore-agent || dpkg -l | grep -i guardicore
find /etc /usr/bin /usr/sbin -xdev -user root -perm -o+w -ls 2>/dev/null
auditctl -w /etc/shadow -p wa -k shadow_watch
auditctl -w /etc/sudoers -p wa -k sudoers_watch