Read the docs
TI-2026-28056 Aliases CVE-2026-37525GHSA-2f7v-pjj3-rvvw

AGL app-framework-binder (afb-daemon) through v19.90.0 contains a privilege escalation…

Priority LOW 35CWE-269Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Privilege escalation
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-269.

Summary

AGL app-framework-binder (afb-daemon) through v19.90.0 contains a privilege escalation vulnerability in the supervision Do command. The on_supervision_call function in src/afb-supervision.c explicitly nullifies the request credentials by calling afb_context_change_cred(&xreq->context, NULL) before dispatching an attacker-controlled API call via xapi->itf->call(xapi->closure, xreq). The NULL propagation chain through afb-context.c:110 (context->credentials = afb_cred_addref(NULL)) and afb-cred.c:163 (returns NULL when cred is NULL) confirms that credentials are zeroed before the target API executes. The attacker controls both api and verb parameters via JSON input, allowing execution of any registered API with a NULL credential context. APIs that rely on context->credentials for authorization decisions may fail open when receiving NULL credentials, enabling privilege escalation. This vulnerability was introduced in commit abbb4599f0b921c6f434b6bd02bcfb277eecf745 on 2018-02-14.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00138 3rd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:o:linuxfoundation:automotive_grade_linux:*:*:*:*:*:*:*:*up to 17.1.12Vulnerablebackstage
  • cpe:2.3:o:linuxfoundation:automotive_grade_linux:*:*:*:*:*:*:*:* Versions up to 17.1.12 Vulnerable ·backstage

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-37525
  2. 2026-10-03 Alias added: GHSA-2f7v-pjj3-rvvw

References

Advisory 1

Other 1

  • TI-2026-28059 AGL app-framework-main thru 17.1.12 contains a Zip Slip path traversal vulnerability… CVSS 3.1CRITICAL 9.8
  • TI-2026-28058 AGL agl-service-can-low-level thru 17.1.12 contains a stack buffer overflow in the uds-c… CVSS 3.1HIGH 7.5
  • TI-2026-28057 AGL app-framework-binder (afb-daemon) through v19.90.0 allows any local process to… CVSS 3.1HIGH 7.8
  • TI-2026-28060 AGL agl-service-can-low-level thru 17.1.12 contains a heap buffer over-read in the… CVSS 3.1HIGH 7.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences