CVE-2026-21034 Missing authorization in Samsung Auto
A local attacker can modify audio configuration in Samsung Auto due to improper export of application components.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-21034?
CVE-2026-21034 is a medium-severity missing authorization vulnerability in Samsung Auto, published on 5 Jun 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Improper export of android application components in Samsung Auto prior to version 3.1.2.61 in Android 15 and 3.2.0.38 in Android 16 allows local attacker to change audio configuration.
Which versions are affected by CVE-2026-21034?
It affects 1 product.
Products include Samsung Auto.
How do I fix CVE-2026-21034?
No fix has been published for CVE-2026-21034 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-21034 being exploited?
There is no known exploitation of CVE-2026-21034 in the wild and no public exploit code.
Sources
Also known as GHSA-959m-qc75-jv6h.