CVE-2026-63349: Privilege Dropping Bypass and Denial of Service in AnyIO Subprocess Module

The AnyIO asynchronous framework serves as a compatibility layer abstracting Python's asyncio and trio engines. A core component of AnyIO is its subprocess execution module, which permits the creation and management of secondary processes through helper functions like open_process and run_process.

On POSIX-compliant operating systems, running highly privileged parent applications must drop permissions when executing untrusted child tasks. This security control is established by setting specific credentials: the primary user identity, primary group, and supplementary groups. In Python, these parameters map to user, group, and extra_groups respectively.

Versions 4.14.0 and 4.14.1 of AnyIO introduced a critical security regression within the POSIX credentials mapping. A logical typo during argument preparation causes the library to ignore or overwrite the specified extra_groups parameter. This failure bypasses supplementary group-dropping policies, exposing systems to privilege escalation attacks.

The root cause of this vulnerability lies in a direct variable assignment error in src/anyio/_core/_subprocesses.py. When a developer provides the extra_groups parameter, AnyIO is designed to construct an arguments dictionary to pass to the asynchronous execution backend.

Instead of assigning the extra_groups list to the corresponding key in kwargs, the code incorrectly maps the primary group variable to the extra_groups key. The vulnerable code statement is: kwargs['extra_groups'] = group.

This assignment leads to two failure states based on the supplied parameters. If group is undefined or None, kwargs['extra_groups'] is set to None, which signals the operating system to inherit all supplementary groups from the parent process. Alternatively, if group is configured as an integer, the backend interpreter throws a TypeError because an integer is not an iterable, inducing a denial of service on process execution.

To analyze the vulnerability, we inspect the mapping logic inside src/anyio/_core/_subprocesses.py in the vulnerable version 4.14.0:

# Vulnerable implementation in AnyIO 4.14.0
if group is not None:
    kwargs["group"] = group
 
if extra_groups is not None:
    kwargs["extra_groups"] = group  # Bug: incorrect variable mapping

The patch in commit eb562e6462ee46b1904e50b02ce00a858cdeb200 corrects this mapping mistake:

# Patched implementation in AnyIO 4.14.2
if group is not None:
    kwargs["group"] = group
 
if extra_groups is not None:
    kwargs["extra_groups"] = extra_groups  # Corrected parameter assignment

The fix is complete and robust because it maps the correct local variable and ensures that the backend receives the intended list of groups. The maintainers added mock tests to verify that every parameter is explicitly verified during integration.

Exploitation of CVE-2026-63349 requires a specific execution context where an application running with elevated privileges executes untrusted commands under dropped privileges.

Consider a daemon running as root that executes a hook script on behalf of a low-privileged user. The daemon attempts to run the hook script with dropped privileges:

await anyio.run_process(
    ["/home/user/hook.sh"],
    user="nobody",
    group="nogroup",
    extra_groups=[]
)

Under AnyIO 4.14.0, because extra_groups is assigned the value of group, the backend receives extra_groups='nogroup'. On some systems, passing a string to an iterable argument raises errors, but if the primary group parameter is not set and defaults to None, the backend receives extra_groups=None. The child process then retains the elevated supplementary groups of the parent (such as docker or shadow), allowing the script to escalate privileges on the host system.

Here is a visual representation of the execution path:

The security impact of CVE-2026-63349 is classified as high, carrying a CVSS v4.0 base score of 7.0. The vulnerability allows an attacker to bypass critical security boundaries designed to enforce least privilege.

If the parent application belongs to administrative groups like docker, disk, or shadow, a child process spawned with lowered UID/GID can still interact with high-privilege resources. This allows an attacker who controls the executed subprocess to gain full administrative control over the host operating system.

No active exploitation has been reported in the wild, and the vulnerability is not listed in the CISA KEV catalog. The attack complexity is rated high because it depends on specific configuration patterns where an application drops credentials using AnyIO subprocess wrappers.

Remediation requires upgrading the anyio package to version 4.14.2 or higher. This completely restores the correct parameter propagation and mitigates the privilege retention issue.

If upgrading is not immediately possible, developers must bypass AnyIO's subprocess module when spawning processes that require privilege dropping. This is achieved by invoking the standard library's asyncio or subprocess APIs directly.

# Safe workaround utilizing standard asyncio
import asyncio
 
async def spawn_safe_process(cmd, user_id, group_id, extra_gids):
    return await asyncio.create_subprocess_exec(
        *cmd,
        user=user_id,
        group=group_id,
        extra_groups=extra_gids
    )

We recommend implementing automated checks to prevent anyio dependencies below version 4.14.2 from being deployed in production environments.