CVE-2026-0305 in Prisma Access Agent
Summary
by MITRE • 09/10/2026
An information disclosure vulnerability in the Palo Alto Networks Prisma® Access Agent on Linux enables a local user to access sensitive configuration data and credentials.
The Prisma Access Agent on macOS, Windows, iOS, Android and Chrome OS is not affected.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/10/2026
A critical information disclosure vulnerability has been identified within the Palo Alto Networks Prisma Access Agent for Linux environments, allowing an authenticated local user to extract sensitive configuration data and stored credentials from the system. This flaw stems from insufficient access controls or improper file permission settings that govern how the agent stores and manages its internal state files on disk. Unlike the counterparts running on macOS, Windows, iOS, Android, and Chrome OS which are not affected by this specific issue, the Linux implementation exposes these artifacts in a manner that permits unauthorized reading by any user account with local shell access to the machine where the agent is installed. The vulnerability effectively bypasses standard operating system security boundaries because it relies on file-level permissions rather than robust encryption or memory-only storage for sensitive secrets.
The technical nature of this flaw aligns closely with CWE-200, which classifies exposure of sensitive information to an unauthorized actor, and specifically relates to CWE-732 as it involves incorrect permission assignment for critical system resources. From a threat modeling perspective using the MITRE ATT&CK framework, this vulnerability facilitates Initial Access persistence mechanisms where an attacker can leverage existing local credentials or configuration details to maintain foothold within a network segment. The exposed data typically includes connection parameters, authentication tokens, and potentially plaintext passwords used by the agent to establish secure tunnels with Prisma Cloud infrastructure. This information is highly valuable for lateral movement attacks, as it allows adversaries to impersonate legitimate endpoints or decrypt traffic if private keys are also compromised in the configuration bundle.
The operational impact of this vulnerability extends beyond simple data leakage into potential compromise of organizational security posture. An attacker who gains local access to a Linux endpoint running Prisma Access Agent can harvest these credentials and use them to authenticate from unauthorized locations, effectively bypassing multi-factor authentication controls if they are tied solely to the device identity rather than user-specific factors. Furthermore, knowledge of internal network configurations revealed in the agent settings may assist attackers in mapping out the protected infrastructure, identifying critical assets behind the Prisma Access gateway, or crafting targeted phishing campaigns that appear legitimate due to accurate contextual details. This undermines the zero-trust principles that such access agents are designed to enforce by ensuring only verified devices and users can connect to corporate resources.
Mitigation strategies must focus on both immediate remediation and long-term architectural improvements. The primary defense is applying the latest software updates provided by Palo Alto Networks, which address these permission errors through corrected file system attributes or enhanced encryption of stored secrets. Administrators should enforce strict least-privilege principles for all user accounts that interact with systems hosting the agent, ensuring that only service-level accounts have write access to installation directories while read permissions are restricted to necessary processes rather than general users. Additionally, organizations should audit local account policies and implement endpoint detection and response solutions capable of monitoring unusual file access patterns associated with credential harvesting tools like mimikatz or custom scripts targeting common configuration paths. Regular rotation of credentials and enabling hardware-backed secure enclaves where available can further reduce the risk posed by static storage vulnerabilities in agent software.