Executive brief
Kahi, a process supervisor and daemon, fails to properly restrict permissions for the processes it manages. This allows managed applications to run with higher privileges (such as root) than intended and creates world-accessible communication sockets. An attacker with local access could exploit these misconfigurations to gain unauthorized access to sensitive data or escalate their control over the system.
Technical details
Kahi (up to v0.1.0-alpha.8) suffers from three distinct privilege and permission issues. First, a failure to attach resolved credentials to spawned child processes causes them to inherit the supervisor's privileges (often root) despite configuration. Second, the daemon fails to call setgroups(2) during privilege drops, leaving supplementary groups (like 'docker') active in child processes. Third, FastCGI unix-domain sockets default to umask-dependent permissions (often world-accessible) unless socket_mode is explicitly defined. These issues are addressed in v0.1.0-alpha.9 by implementing fail-closed privilege handling and restrictive default socket permissions (0700).
Affected products
- kahiteam kahi <= v0.1.0-alpha.8
Timeline
- 2026-05-26: disclosed: Identified during security review
- 2026-05-26: advisory: Initial internal advisory published
- 2026-06-30: patched: Public advisory and patch released