Which versions of AnyIO are affected by CVE-2026-63349?

AnyIO 4.14.0 and 4.14.1 silently fail to drop supplementary group memberships when applications use the extra_groups argument to run less-privileged child processes on POSIX systems, weakening a…. A patch is available.

Is there a public PoC exploit available for CVE-2026-63349?

Yes, a public proof-of-concept exploit is available for CVE-2026-63349. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-63349?

Within 24 hours, inventory every application running AnyIO 4.14.0 or 4.14.1 on POSIX and grep the codebase for anyio.run_process() or anyio.open_process() calls that pass extra_groups, since a child launched after extra_groups=[] (or any group-reset intent) is inheriting the parent's supplementary groups despite the code appearing correct; flag any call that also passes group, because the integer-forwarding defect causes the launch to abort with a TypeError, and capture the effective process state of any already-running child to confirm the control gap is real. Within 7 days, remediate affected paths by downgrading to an AnyIO release prior to 4.14.0 or, if a patched release is published, upgrading to it; where neither is operationally possible, replace the AnyIO helper with a direct subprocess launch that explicitly calls os.setgroups([]) in the child setup path before exec, and verify the fix by reading the Groups field from /proc/ /status of the spawned child to confirm it is empty. Within 30 days, ship a permanent upgrade to the first AnyIO version that corrects the argument forwarding once released by the vendor, add an automated regression test that asserts spawned children carry no inherited supplementary groups, and audit all other privilege-dropping boundaries in the environment to confirm they are not relying on the same now-known-broken pattern; note that there is no public exploit identified at time of analysis, so this work can proceed on a risk-prioritized basis rather than as an emergency change.

AnyIO CVE-2026-63349

Q: What is the CVSS score of CVE-2026-63349?

CVE-2026-63349 has a CVSS 4.0 base score of 7.0 (High). CVSS vector: CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-83191 HIGH

Incorrect Privilege Assignment (CWE-266)

2026-09-18 GitHub_M

GHSA-3w57-8xmc-8v26

Python Information Disclosure Anyio

7.0

CVSS 4.0 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

7.0 HIGH

CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.7 MEDIUM

Local privilege-drop boundary (AV:L), requires privileged app using the specific extra_groups pattern (PR:H) plus a follow-on child compromise (AC:H); retained groups can expose confidentiality and integrity (C:H/I:H), no availability impact.

3.1 AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N

4.0 AV:L/AC:H/AT:P/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Local

Attack Complexity

High

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

POC Analysis Generated

Sep 18, 2026 - 19:27 vuln.today

Patch available

Sep 18, 2026 - 18:03 EUVD

Metadata Corrected

Sep 18, 2026 - 17:40 vuln.today

tag: Python added

Analysis Generated

Sep 18, 2026 - 17:36 vuln.today

CVE Published

Sep 18, 2026 - 17:02 cve.org

HIGH 7.0

DescriptionCVE.org

AnyIO is a high level asynchronous concurrency and networking framework that works on top of either Trio or asyncio. In 4.14.0, AnyIO accepts the POSIX extra_groups argument in anyio.run_process() and anyio.open_process(), but open_process() forwards the group argument to the backend instead of extra_groups. A caller that supplies extra_groups=[] to clear inherited supplementary groups can therefore launch a child that retains the parent process groups, undermining a privilege-dropping boundary. If group is also supplied, the integer group value is passed where an iterable of supplementary groups is expected and the launch can fail with TypeError. This issue affects POSIX applications that rely on AnyIO subprocess helpers to launch less-privileged child processes. This issue is fixed in version 4.14.2.

AnalysisAI

Silent privilege-separation failure in AnyIO 4.14.0 and 4.14.1 on POSIX: when an application passes extra_groups to anyio.run_process() or anyio.open_process() to drop or clear supplementary groups before launching a less-privileged child, the library forwards the wrong variable (the group argument) to the backend, so an intended extra_groups=[] reset is ignored and the child silently inherits the parent's supplementary groups; if group is also supplied, the integer is passed where an iterable is expected and the launch aborts with TypeError. Impact is limited to local, non-network scenarios and only affects applications that already run with the privileges being dropped (PR:H) and rely on this specific code pattern to establish a privilege-dropping boundary, with no consequence unless the spawned child is subsequently compromised; no public exploit identified at time of analysis.

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Applies ONLY to POSIX applications that use anyio.run_process() or anyio.open_process() on AnyIO 4.14.0 or 4.14.1, AND that pass the extra_groups argument to establish a privilege-dropping boundary (typically extra_groups=[] to clear inherited supplementary groups when launching a less-privileged child). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	This is a privilege-management correctness flaw (CWE-266), not an attacker-triggered exploit primitive. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Vendor-released patch: upgrade to anyio 4.14.2 (PyPI release notes: https://github.com/agronholm/anyio/releases/tag/4.14.2), which contains the one-line correction in src/anyio/_core/_subprocesses.py plus a regression test verifying full argument pass-through; the advisory is at https://github.com/agronholm/anyio/security/advisories/GHSA-3w57-8xmc-8v26 and the upstream fix is PR/commit eb562e6462ee46b1904e50b02ce00a858cdeb200 (https://github.com/agronholm/anyio/pull/1209). … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, inventory every application running AnyIO 4.14.0 or 4.14.1 on POSIX and grep the codebase for anyio.run_process() or anyio.open_process() calls that pass extra_groups, since a child launched after extra_groups=[] (or any group-reset intent) is inheriting the parent's supplementary groups despite the code appearing correct; flag any call that also passes group, because the integer-forwarding defect causes the launch to abort with a TypeError, and capture the effective process state of any already-running child to confirm the control gap is real. …

Threat intelligence, references, and detailed analysis are available after sign-in.