CVE-2026-37526

High

Published: 01/05/2026(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

A vulnerability in AGL app-framework-binder (afb-daemon) allows local processes to execute privileged supervision commands without authentication. The on_supervision_call function in src/afb-supervision.c dispatches eight commands without credential verification.

Risk Assessment

A low-privileged local process can kill the daemon (DoS attack), execute arbitrary API calls, close user sessions, or leak the global configuration. This poses a serious threat to the integrity and availability of the system.

Recommendation

It is recommended to implement authentication mechanisms for supervision commands and to apply DAC protection for the abstract socket to restrict access to these functions.

Other vulnerabilities in AGL app-framework-binder (afb-daemon)

CVE-2026-37525High
The AGL app-framework-binder (afb-daemon) version v19.90.0 contains a privilege escalation vulnerability in the supervision Do command. The on_supervision_call function nullifies the request credentials before executing an attacker-controlled API call, allowing any registered API to be executed with a NULL credential context.

Original NVD description (English source)

AGL app-framework-binder (afb-daemon) through v19.90.0 allows any local process to execute privileged supervision commands (Exit, Do, Sclose, Config, Trace, Debug, Token, slist) without authentication via the abstract Unix socket @urn:AGL:afs:supervision:socket. The on_supervision_call function in src/afb-supervision.c dispatches all 8 commands without any credential verification. The abstract socket has no DAC protection, as acknowledged in the official CAUTION comment in src/afs-supervision.h. This allows a low-privileged local process to kill the daemon (DoS via Exit command), execute arbitrary API calls (via Do command), close arbitrary user sessions (via Sclose command), or leak the entire global configuration (via Config command). The vulnerability was introduced in commit b8c9d5de384efcfa53ebdb3f0053d7b3723777e1 on 2017-06-29.