Kahi releases up to v0.1.0-alpha.8 have three security issues: (1) a high-severity flaw where per-process privilege drop was not applied, causing child processes to run with the supervisor's privileges (often root) instead of the configured lower-privilege user; (2) a medium-severity issue where supplementary groups were not reset during privilege drop, allowing inherited elevated group privileges; and (3) a medium-severity issue where FastCGI unix sockets were world-accessible by default unless an explicit restrictive socket_mode was set. These issues were identified in a full codebase security review and fixed in v0.1.0-alpha.9 by enforcing fail-closed privilege handling, resetting supplementary groups, and defaulting FastCGI socket permissions to 0700.

Processes intended to run with reduced privileges may instead run with elevated privileges, increasing the risk of privilege escalation. Supplementary groups with elevated permissions remain active after privilege drop, potentially granting unintended access. FastCGI unix sockets being world-accessible by default allow any local user to connect, potentially exposing sensitive services or data.

Upgrade to Kahi version v0.1.0-alpha.9, which fixes all identified privilege and permission issues by enforcing privilege drops or refusing to start, resetting supplementary groups, and setting restrictive default socket permissions. For versions <= v0.1.0-alpha.8, workarounds include running the supervisor as the intended unprivileged user instead of relying on per-process user configuration, explicitly setting restrictive socket_mode on FastCGI programs, and avoiding running the supervisor as root where possible.