Live › vulnerability › CVE-2026-120307
The Beta9 worker's sandbox file API turns container paths into host paths without confining them, so a tenant can escape the sandbox. An attacker with a workspace token and one running sandbox can read, write, list and delete files on the worker as root, including other tenants' files and the worker pod's Kubernetes service account token.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-01 13:20 UTC. All times on this page are UTC.
Teams that run the Beta9 worker, especially remote nodes that host sandboxes for multiple tenants. The file API is reachable by any tenant holding a workspace token with one running sandbox, so exposure depends on who has such tokens and whether other tenants share the machine. Deployments that only run the managed service or a single trusted tenant are less exposed, but the shipped manifests bind the service account to cluster-admin, which raises the impact.
No product ranges from the sources yet.
0.1.756.0.1.756 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Beta9 worker serves the sandbox file API from outside the container. getHostPathFromContainerPath turns the tenant's container path into a worker path. If the unresolved path starts with a mount destination, including the default upload mount at /tmp/.beta9, the remainder is joined onto that mount's source with filepath.Join, which cleans parent-directory segments after the prefix check. A long enough run of those segments names any absolute path on the worker. A path that matches no mount is joined onto the container root and opened in the worker's own filesystem, so an absolute symbolic link such as /var/run pointing at /run is followed against the worker root. Upload, download, stat, list, find-in-files, replace-in-files, and delete-file all call this helper. A tenant with a workspace token and one running sandbox can read, write, list, and delete files on the hosting worker as root, including files of other tenants on that machine. A read-only proof downloaded the worker pod's Kubernetes service account token through the file API for a path that did not exist inside the sandbox. In the shipped remote-node manifests that service account is bound to cluster-admin. Fixed in worker 0.1.756: sandbox file operations and workspace sync open paths with os.OpenRoot, so parent-directory and symlink lookups stay inside the container root or the mount source.
This page as .md · .json · in your agent: get_signal("CVE-2026-120307")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.