CVE-2026-37526: High severity Automotive Grade Linux app-framework-binder (afb-daemon) vulnerability
AGL app-framework-binder (afb-daemon) through v19.90.0 allows any local process to execute privileged supervision commands (Exit, Do, Sclose, Config, Trace, Debug, Token, slist) without authentication via the abstract Unix socket @urn:AGL:afs:supervision:socket. The onsupervisioncall function in src/afb-supervision.c dispatches all 8 commands without any credential verification. The abstract socket has no DAC protection, as acknowledged in the official CAUTION comment in src/afs-supervision.h. This allows a low-privileged local process to kill the daemon (DoS via Exit command), execute arbitrary API calls (via Do command), close arbitrary user sessions (via Sclose command), or leak the entire global configuration (via Config command). The vulnerability was introduced in commit b8c9d5de384efcfa53ebdb3f0053d7b3723777e1 on 2017-06-29.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-37526?
CVE-2026-37526 is classified as a high severity vulnerability due to its potential to allow unauthorized access to privileged supervision commands.
How do I fix CVE-2026-37526?
To fix CVE-2026-37526, update the app-framework-binder (afb-daemon) to a version later than 19.90.0 where the vulnerability is patched.
Who is affected by CVE-2026-37526?
CVE-2026-37526 affects users of Automotive Grade Linux app-framework-binder (afb-daemon) version 19.90.0 and earlier.
What are the potential consequences of exploiting CVE-2026-37526?
Exploiting CVE-2026-37526 could allow an attacker to execute critical commands on the system without authentication, which could compromise system integrity.
Is there a workaround for CVE-2026-37526 until a patch is applied?
A temporary workaround for CVE-2026-37526 involves restricting access to the abstract Unix socket used by the afb-daemon.