{"id":"CVE-2026-120307","kind":"vulnerability","aliases":["CVE-2026-120307"],"related":[],"title":"Beta9 worker: sandbox file API reads and writes host files as root","description":"The Beta9 worker serves the sandbox file API from outside the container. getHostPathFromContainerPath turns the tenant's container path into a worker path. If the unresolved path starts with a mount destination, including the default upload mount at /tmp/.beta9, the remainder is joined onto that mount's source with filepath.Join, which cleans parent-directory segments after the prefix check. A long enough run of those segments names any absolute path on the worker. A path that matches no mount is joined onto the container root and opened in the worker's own filesystem, so an absolute symbolic link such as /var/run pointing at /run is followed against the worker root. Upload, download, stat, list, find-in-files, replace-in-files, and delete-file all call this helper. A tenant with a workspace token and one running sandbox can read, write, list, and delete files on the hosting worker as root, including files of other tenants on that machine. A read-only proof downloaded the worker pod's Kubernetes service account token through the file API for a path that did not exist inside the sandbox. In the shipped remote-node manifests that service account is bound to cluster-admin. Fixed in worker 0.1.756: sandbox file operations and workspace sync open paths with os.OpenRoot, so parent-directory and symlink lookups stay inside the container root or the mount source.","summary":"The Beta9 worker's sandbox file API turns container paths into host paths without confining them, so a tenant can escape the sandbox. An attacker with a workspace token and one running sandbox can read, write, list and delete files on the worker as root, including other tenants' files and the worker pod's Kubernetes service account token.","severity":"critical","cvss":9.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["beta9","kubernetes","multi-tenant","other","self-hosted"],"not_affected_if":["managed-hosting","single-tenant-worker"],"how_to_check":"- Check the worker version; affected builds are before `0.1.756`.\n- Confirm whether the worker runs on shared hosts with other tenants' sandboxes.\n- Check whether the worker's Kubernetes service account is bound to cluster-admin in the remote-node manifests.","fix":"- Beta9 worker: move to `0.1.756` or later.","status":"open","published_at":"2026-11-01T13:18:01+00:00","first_seen_at":"2026-11-01T13:20:07+00:00","triaged_at":"2026-11-01T13:21:53+00:00","updated_at":"2026-11-01T13:21:53+00:00","category":"other","confidence":0.8,"triage":{"at":"2026-11-01T13:21:53Z","model":"claude-haiku-5-5","output":{"fix":"- Beta9 worker: move to `0.1.756` or later.","reach":"internet","title":"Beta9 worker: sandbox file API reads and writes host files as root","impact":"high","summary":"The Beta9 worker's sandbox file API turns container paths into host paths without confining them, so a tenant can escape the sandbox. An attacker with a workspace token and one running sandbox can read, write, list and delete files on the worker as root, including other tenants' files and the worker pod's Kubernetes service account token.","audience":"businesses","category":"other","nicknames":[],"who_cares":["beta9","self-hosted","kubernetes","multi-tenant"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"Tenant reads worker service account token and gains cluster-admin.","analyst_note":"Confirm the affected version range beyond the single fixed version 0.1.756 and whether the NVD entry lists a CVSS vector to verify the 9.9 score.","how_to_check":"- Check the worker version; affected builds are before `0.1.756`.\n- Confirm whether the worker runs on shared hosts with other tenants' sandboxes.\n- Check whether the worker's Kubernetes service account is bound to cluster-admin in the remote-node manifests.","plain_action":"","needs_analyst":true,"not_affected_if":["single-tenant-worker","managed-hosting"],"who_is_affected":"Teams that run the Beta9 worker, especially remote nodes that host sandboxes for multiple tenants. The file API is reachable by any tenant holding a workspace token with one running sandbox, so exposure depends on who has such tokens and whether other tenants share the machine. Deployments that only run the managed service or a single trusted tenant are less exposed, but the shipped manifests bind the service account to cluster-admin, which raises the impact.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"critical"},"cost_usd":0.00078,"input_tokens":4437,"output_tokens":673,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-120307':15A,18A '-2026':14A,17A '/run':190C '/tmp/.beta9':124C '/var/run':187C '0.1.756':295C 'absolut':155C,182C 'account':84B,260C,285C 'admin':291C 'api':5A,34B,93C,265C 'attack':52B 'beta9':1A,19B,29B,87C 'bound':287C 'call':214C 'check':145C 'clean':137C 'cluster':290C 'cluster-admin':289C 'confin':42B 'contain':36B,97C,103C,170C,316C 'cve':13A,16A 'default':120C 'delet':66B,211C,232C 'delete-fil':210C 'destin':117C 'directori':140C,309C 'download':198C,253C 'enough':148C 'escap':48B 'exist':272C 'file':4A,10A,33B,67B,76B,92C,204C,208C,212C,233C,241C,264C,297C 'filepath.join':135C 'filesystem':179C 'find':202C 'find-in-fil':201C 'fix':292C 'follow':192C 'gethostpathfromcontainerpath':98C 'helper':216C 'host':9A,27B,39B,236C 'includ':73B,118C,240C 'insid':273C,314C 'join':128C,167C 'kubernet':20B,82B,258C 'link':184C 'list':64B,200C,230C 'long':147C 'lookup':312C 'machin':247C 'manifest':282C 'match':163C 'mount':116C,122C,131C,165C,320C 'multi':22B 'multi-ten':21B 'name':153C 'node':281C 'one':58B,224C 'onto':129C,168C 'open':173C,302C 'oper':298C 'os.openroot':305C 'outsid':95C 'parent':139C,308C 'parent-directori':138C,307C 'path':37B,40B,104C,108C,112C,156C,161C,268C,303C 'pod':80B,256C 'point':188C 'prefix':144C 'proof':252C 'read':6A,62B,228C,250C 'read-on':249C 'remaind':126C 'remot':280C 'remote-nod':279C 'replac':206C 'replace-in-fil':205C 'root':12A,72B,171C,196C,239C,317C 'run':59B,149C,225C 'sandbox':3A,32B,50B,60B,91C,226C,275C,296C 'segment':141C,152C 'self':26B 'self-host':25B 'serv':89C 'servic':83B,259C,284C 'ship':278C 'sourc':133C,321C 'start':113C 'stat':199C 'stay':313C 'symbol':183C 'symlink':311C 'sync':301C 'tenant':23B,46B,75B,101C,218C,244C 'token':56B,85B,222C,261C 'turn':35B,99C 'unresolv':111C 'upload':121C,197C 'without':41B 'worker':2A,30B,70B,79B,88C,107C,159C,176C,195C,237C,255C,294C 'workspac':55B,221C,300C 'write':8A,63B,229C","nicknames":[],"mitigations":[],"who_affected":"Teams that run the Beta9 worker, especially remote nodes that host sandboxes for multiple tenants. The file API is reachable by any tenant holding a workspace token with one running sandbox, so exposure depends on who has such tokens and whether other tenants share the machine. Deployments that only run the managed service or a single trusted tenant are less exposed, but the shipped manifests bind the service account to cluster-admin, which raises the impact.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-11-01T13:18:01+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cvss_by":"reefs@jfrog.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120307","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120307","severity":null,"published_at":"2026-11-01T13:18:01+00:00","modified_at":"2026-11-01T13:18:01+00:00","first_seen_at":"2026-11-01T13:20:07+00:00","fetched_at":"2026-11-01T13:20:07+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}