CVE-2026-37525

AGL app-framework-binder (afb-daemon) through v19.90.0 contains a privilege escalation vulnerability in the supervision Do command. The on_supervision_call function in src/afb-supervision.c explicitly nullifies the request credentials by calling afb_context_change_cred(&xreq->context, NULL) before dispatching an attacker-controlled API call via xapi->itf->call(xapi->closure, xreq). The NULL propagation chain through afb-context.c:110 (context->credentials = afb_cred_addref(NULL)) and afb-cred.c:163 (returns NULL when cred is NULL) confirms that credentials are zeroed before the target API executes. The attacker controls both api and verb parameters via JSON input, allowing execution of any registered API with a NULL credential context. APIs that rely on context->credentials for authorization decisions may fail open when receiving NULL credentials, enabling privilege escalation. This vulnerability was introduced in commit abbb4599f0b921c6f434b6bd02bcfb277eecf745 on 2018-02-14.

• CWE-269

• https://gerrit.automotivelinux.org/gerrit/src/app-framework-binderBroken Link
• https://gist.github.com/sgInnora/8526eedcfd826d05ef1fc45d8f405643Third Party Advisory

Published

May 1, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-3750A security vulnerability has been detected in ContiNew Admin…7.2
• CVE-2026-37503Cross-Site Scripting (XSS) in V2Board thru 1.7.4. The custom…4.8
• CVE-2026-37504Sensitive server_token exposed via GET parameter in V2Board …7.5
• CVE-2026-37505SQL Injection via ORDER BY clause in V2Board thru 1.7.4. In …4.9
• CVE-2026-3751A vulnerability was detected in SourceCodester Employee Task…7.2
• CVE-2026-3752A flaw has been found in SourceCodester Employee Task Manage…7.2
• CVE-2026-37526AGL app-framework-binder (afb-daemon) through v19.90.0 allow…7.8
• CVE-2026-3753A vulnerability has been found in SourceCodester Sales and I…8.8
• CVE-2026-37530AGL agl-service-can-low-level thru 17.1.12 contains a stack …7.5
• CVE-2026-37531AGL app-framework-main thru 17.1.12 contains a Zip Slip path…9.8
• CVE-2026-37532AGL agl-service-can-low-level thru 17.1.12 contains a heap b…7.1
• CVE-2026-37534Integer underflow vulnerability in Open-SAE-J1939 thru commi…9.8