Beta9 container escape via unvalidated sandbox file paths
Summary
| CVE | CVE-2026-120307 |
|---|---|
| State | PUBLISHED |
| Assigner | JFROG |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-11-01 13:18:01 UTC |
| Updated | 2026-11-02 19:35:33 UTC |
| Description | The Beta9 worker serves the sandbox file API from outside the container. getHostPathFromContainerPath turns the tenant's container path into a worker path. If the unresolved path starts with a mount destination, including the default upload mount at /tmp/.beta9, the remainder is joined onto that mount's source with filepath.Join, which cleans parent-directory segments after the prefix check. A long enough run of those segments names any absolute path on the worker. A path that matches no mount is joined onto the container root and opened in the worker's own filesystem, so an absolute symbolic link such as /var/run pointing at /run is followed against the worker root. Upload, download, stat, list, find-in-files, replace-in-files, and delete-file all call this helper. A tenant with a workspace token and one running sandbox can read, write, list, and delete files on the hosting worker as root, including files of other tenants on that machine. A read-only proof downloaded the worker pod's Kubernetes service account token through the file API for a path that did not exist inside the sandbox. In the shipped remote-node manifests that service account is bound to cluster-admin. Fixed in worker 0.1.756: sandbox file operations and workspace sync open paths with os.OpenRoot, so parent-directory and symlink lookups stay inside the container root or the mount source. |
Risk And Classification
Primary CVSS: v3.1 9.9 CRITICAL from [email protected]
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Problem Types: CWE-22 | CWE-23 | CWE-59 | CWE-22 CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | CWE-23 CWE-23: Relative Path Traversal | CWE-59 CWE-59: Improper Link Resolution Before File Access ('Link Following')
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.1 | [email protected] | Secondary | 9.9 | CRITICAL | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H |
| 3.1 | CNA | CVSS | 9.9 | CRITICAL | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H |
CVSS v3.1 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Beam-cloud | Beta9 Worker | affected 0.1.756 semver | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| github.com/beam-cloud/beta9 | [email protected] | github.com | |
| github.com/beam-cloud/beta9/pull/1897 | [email protected] | github.com | |
| github.com/beam-cloud/beta9/releases/tag/worker-0.1.756 | [email protected] | github.com | |
| github.com/beam-cloud/beta9/commit/a28bf12cf0007c792a25d8ed282b4e8bf6f30393 | [email protected] | github.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
CNA: Natan Nehorai (en)
CNA: JFrog Security Research (en)
Additional Advisory Data
| Source | Time | Event |
|---|---|---|
| CNA | 2026-09-15T04:03:00.000Z | Fix merged in pull request 1897 (commit a28bf12) |
| CNA | 2026-09-15T04:03:00.000Z | Fixed release worker-0.1.756 published. No vendor security advisory was filed with the pull request. |
Solutions
CNA: Upgrade the Beta9 worker to 0.1.756 or later. Sandbox file APIs and workspace sync use os.OpenRoot, so parent-directory segments and symbolic links stay inside the container root or the mount source. File operations refuse read-only mounts and do not write through a symlink swapped in after path resolution. The fix is commit a28bf12 (pull request 1897), released as worker-0.1.756 on 2026-09-15.