DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-63349: CVE-2026-63349: Privilege Dropping Bypass and Denial of Service in AnyIO Subprocess Module

#security #cve #cybersecurity

CVE-2026-63349: Privilege Dropping Bypass and Denial of Service in AnyIO Subprocess Module

Vulnerability ID: CVE-2026-63349
CVSS Score: 7.0
Published: 2026-09-18

CVE-2026-63349 is a critical privilege-dropping bypass vulnerability in the AnyIO asynchronous framework (versions 4.14.0 and 4.14.1) on POSIX platforms. Due to a variable assignment typo, supplementary groups specified by the developer are not correctly propagated to the execution backend, resulting in subprocesses retaining the parent process's elevated supplementary group permissions.

TL;DR

A typo in AnyIO 4.14.0 and 4.14.1 causes subprocesses to retain the parent's supplementary groups (such as 'docker' or 'shadow'), bypassing security boundaries designed to drop privileges.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-266 / CWE-269
  • Attack Vector: Local
  • CVSS v4.0 Score: 7.0 (High)
  • Exploit Status: Proof-of-Concept / Theoretical
  • KEV Status: Not Listed
  • Affected Component: anyio._core._subprocesses

Affected Systems

  • AnyIO (Python asynchronous library) versions 4.14.0 and 4.14.1 running on POSIX systems
  • AnyIO: >= 4.14.0, < 4.14.2 (Fixed in: 4.14.2)

Code Analysis

Commit: eb562e6

Fix typo in extra_groups parameter propagation

@@ -176,7 +176,7 @@ async def open_process(
         kwargs["group"] = group

     if extra_groups is not None:
-        kwargs["extra_groups"] = group
+        kwargs["extra_groups"] = extra_groups

     if umask >= 0:
         kwargs["umask"] = umask
Enter fullscreen mode Exit fullscreen mode

Mitigation Strategies

  • Upgrade to AnyIO version 4.14.2 or higher.
  • Directly utilize Python's native asyncio or subprocess modules to execute processes with privilege dropping in environment-constrained setups.

Remediation Steps:

  1. Identify all installed instances of AnyIO within the Python environment using 'pip show anyio'.
  2. Update requirements.txt, pyproject.toml, or Pipfile configurations to enforce dependencies of anyio >= 4.14.2.
  3. Run automated vulnerability scanning tools to verify the closure of vulnerability CVE-2026-63349.

References

Read the full report for CVE-2026-63349 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)