github.com/kahiteam/kahi · Kahi has privilege-drop and socket/log permission issues
Affects github.com/kahiteam/kahiSource GCVE Database
Rated by Threat Radar
- Patch
- Available – fixed in 0.1.0-alpha.9
Data as of 30 Jun 2026, 23:52 UTC
What to do
Upgrade github.com/kahiteam/kahi to 0.1.0-alpha.9.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| Gogithub.com/kahiteam/kahi | Affected
| Fixed in
|
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
Upgrade to Kahi version v0.1.0-alpha.9, which fixes all identified privilege and permission issues by enforcing privilege drops or refusing to start, resetting supplementary groups, and setting restrictive default socket permissions. For versions <= v0.1.0-alpha.8, workarounds include running the supervisor as the intended unprivileged user instead of relying on per-process user configuration, explicitly setting restrictive socket_mode on FastCGI programs, and avoiding running the supervisor as root where possible.
Description
Kahi versions up to and including v0.1.0-alpha.8 have three privilege and permission issues related to improper privilege dropping and socket permissions. These issues allow processes to run with higher privileges than intended and expose FastCGI unix sockets to unauthorized local users. The issues are fixed in version v0.1.0-alpha.9, which enforces fail-closed privilege handling and restricts socket permissions by default.