An unprotected abstract Unix socket @urn:AGL:afs:supervision:socket used by the AGL app-framework-binder (afb-daemon) allows any local process to invoke privileged supervision commands without authentication. The commands include Exit, Do, Sclose, Config, Trace, Debug, Token, and slist. Because the socket lacks discretionary access control and the server’s on_supervision_call dispatcher checks no credentials, a low‑privileged process can terminate the daemon, execute arbitrary API calls, close user sessions, or expose the entire global configuration. This yields local privilege escalation or corruption of the afb‑daemon’s behavior and can lead to denial of service or information disclosure.

The flaw exists in the AGL app-framework-binder up to and including version 19.90.0. Installations that use the afb‑daemon and expose the supervision socket are vulnerable. No vendor or product list beyond the AGL framework itself is provided.

The CVSS score of 7.8 classifies the issue as high severity. The EPSS score is not reported, so the exploitation probability is unknown, but the vulnerability relies on local execution of an unfiltered socket. The bug was introduced in 2017, and the vulnerability is not listed in CISA's KEV catalog. There is no documented remote exploitation; a low‑privileged local user with the ability to connect to the abstract socket can exploit the flaw, which can result in service disruption or data leakage.