# CVE-2026-37525: Automotive Grade Linux afb-daemon privilege escalation in supervision Do command

Source: https://junglewise.ai/threats/cve-2026-37525-automotive-grade-linux-afb-daemon-privilege-escalation-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-01. Updated: 2026-05-18  
License: CC BY 4.0 with a link back

CVE-2026-37525 · Severity: high · CVSS 7.8 · Published 2026-05-01

Automotive Grade Linux (AGL) uses a component called the app-framework-binder to manage communication between different automotive applications. A security flaw in this component allows a low-privileged local application to bypass security checks and execute commands with higher system privileges. This could allow an attacker to gain unauthorized control over sensitive vehicle functions or access restricted system data.

Technologies: [Linuxfoundation Automotive Grade Linux](https://junglewise.ai/threats/technologies/automotive-grade-linux). Vendors: [Automotive Grade Linux](https://junglewise.ai/threats/vendors/automotive-grade-linux), [Linuxfoundation](https://junglewise.ai/threats/vendors/linuxfoundation).

## Quick answers

**Is CVE-2026-37525 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-37525 being exploited in the wild.

**How severe is CVE-2026-37525?** High severity, with a CVSS score of 7.8, published 1 May 2026.

**Which products and versions are affected?** Automotive Grade Linux App-Framework-Binder through v19.90.0.

**Is there a fix for CVE-2026-37525?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-37525 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-37525?** Check whether you run Automotive Grade Linux App-Framework-Binder or Linuxfoundation Automotive Grade Linux at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A privilege escalation vulnerability exists in the afb-daemon component of Automotive Grade Linux (AGL) due to improper credential management in the supervision 'Do' command. The function 'on_supervision_call' in 'src/afb-supervision.c' explicitly nullifies request credentials by calling 'afb_context_change_cred' with a NULL value before dispatching an attacker-controlled API call. Because the attacker controls both the 'api' and 'verb' parameters via JSON input, they can invoke any registered API. If the target API relies on the credential context for authorization decisions, it may 'fail open' when encountering the NULL credentials, allowing a local low-privileged process to execute privileged operations.

## Affected products

- Automotive Grade Linux (AGL) app-framework-binder (afb-daemon) through v19.90.0

## Timeline

- 2018-02-14: other: Vulnerability introduced in commit abbb4599f0b921c6f434b6bd02bcfb277eecf745
- 2026-04-30: disclosed: Initial disclosure by Innora Security Research
- 2026-05-01: advisory: CVE published to NVD

## References

- [https://gerrit.automotivelinux.org/gerrit/src/app-framework-binder](https://gerrit.automotivelinux.org/gerrit/src/app-framework-binder)
- [https://gist.github.com/sgInnora/8526eedcfd826d05ef1fc45d8f405643](https://gist.github.com/sgInnora/8526eedcfd826d05ef1fc45d8f405643)

## Related threats

- [Automotive Grade Linux agl-service-can-low-level heap over-read in isotp-c](https://junglewise.ai/threats/cve-2026-37532-automotive-grade-linux-agl-service-can-low-level-heap-over-read)
- [Automotive Grade Linux app-framework-main Zip Slip in widget installer](https://junglewise.ai/threats/cve-2026-37531-automotive-grade-linux-app-framework-main-zip-slip-in-widget)
- [Automotive Grade Linux agl-service-can-low-level stack overflow in uds-c](https://junglewise.ai/threats/cve-2026-37530-automotive-grade-linux-agl-service-can-low-level-stack-overflow)
- [Automotive Grade Linux afb-daemon improper access control in supervision socket](https://junglewise.ai/threats/cve-2026-37526-automotive-grade-linux-afb-daemon-improper-access-control-in)