CVE-2026-37525
HighSummary
The AGL app-framework-binder (afb-daemon) version v19.90.0 contains a privilege escalation vulnerability in the supervision Do command. The on_supervision_call function nullifies the request credentials before executing an attacker-controlled API call, allowing any registered API to be executed with a NULL credential context.
Risk Assessment
An attacker can exploit this vulnerability to escalate privileges, potentially leading to unauthorized access to system resources. Systems relying on context credentials for authorization decisions may be at significant risk.
Recommendation
It is recommended to update to the latest version of AGL app-framework-binder to eliminate this vulnerability. A security audit of the APIs should also be conducted to ensure they are not susceptible to similar attacks.
Other vulnerabilities in AGL app-framework-binder (afb-daemon)
Original NVD description (English source)
AGL app-framework-binder (afb-daemon) through v19.90.0 contains a privilege escalation vulnerability in the supervision Do command. The on_supervision_call function in src/afb-supervision.c explicitly nullifies the request credentials by calling afb_context_change_cred(&xreq->context, NULL) before dispatching an attacker-controlled API call via xapi->itf->call(xapi->closure, xreq). The NULL propagation chain through afb-context.c:110 (context->credentials = afb_cred_addref(NULL)) and afb-cred.c:163 (returns NULL when cred is NULL) confirms that credentials are zeroed before the target API executes. The attacker controls both api and verb parameters via JSON input, allowing execution of any registered API with a NULL credential context. APIs that rely on context->credentials for authorization decisions may fail open when receiving NULL credentials, enabling privilege escalation. This vulnerability was introduced in commit abbb4599f0b921c6f434b6bd02bcfb277eecf745 on 2018-02-14.