Is CVE-2026-37526 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-37526 being exploited in the wild.

How severe is CVE-2026-37526?

High severity, with a CVSS score of 7.8, published 1 May 2026.

Which products and versions are affected?

Automotive Grade Linux App-Framework-Binder through v19.90.0.

Is there a fix for CVE-2026-37526?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-37526 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2026-37526?

Check whether you run Automotive Grade Linux App-Framework-Binder or Linuxfoundation Automotive Grade Linux at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-37526: Automotive Grade Linux afb-daemon improper access control in supervision socket

CVE-2026-37526 · Severity: high · CVSS 7.8 · Published 2026-05-01

The Automotive Grade Linux (AGL) application framework contains a security flaw that allows any local process to issue administrative commands to the system's background services. This component is responsible for managing how applications interact with the vehicle's hardware and software. An attacker with low-level access to the system could exploit this to shut down critical services, execute unauthorized commands, or steal sensitive configuration data, potentially compromising the vehicle's operational integrity.

Technologies: Linuxfoundation Automotive Grade Linux. Vendors: Automotive Grade Linux, Linuxfoundation.

Quick answers

Is CVE-2026-37526 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-37526 being exploited in the wild.
How severe is CVE-2026-37526?: High severity, with a CVSS score of 7.8, published 1 May 2026.
Which products and versions are affected?: Automotive Grade Linux App-Framework-Binder through v19.90.0.
Is there a fix for CVE-2026-37526?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-37526 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2026-37526?: Check whether you run Automotive Grade Linux App-Framework-Binder or Linuxfoundation Automotive Grade Linux at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The afb-daemon component in AGL's app-framework-binder fails to implement access control on its abstract Unix supervision socket (@urn:AGL:afs:supervision:socket). The 'on_supervision_call' function in 'src/afb-supervision.c' dispatches eight privileged commands (including Exit, Do, Sclose, and Config) without verifying the credentials or UID of the calling process. Because the abstract socket lacks Discretionary Access Control (DAC) protection, any low-privileged local process can connect to it. An attacker can exploit this to perform a Denial of Service (DoS) by killing the daemon, execute arbitrary API calls, terminate user sessions, or leak global configuration data.

Affected products

Automotive Grade Linux (AGL) app-framework-binder (afb-daemon) through v19.90.0

Timeline

2017-06-29: other: Vulnerability introduced in commit b8c9d5de384efcfa53ebdb3f0053d7b3723777e1
2026-04-30: disclosed: Reported by Innora Security Research
2026-05-01: advisory: CVE published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.