---
id: "CVE-2026-120307"
kind: "vulnerability"
aliases: ["CVE-2026-120307"]
title: "Beta9 worker: sandbox file API reads and writes host files as root"
severity: "critical"
cvss: 9.9
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["beta9", "kubernetes", "multi-tenant", "other", "self-hosted"]
not_affected_if: ["managed-hosting", "single-tenant-worker"]
published_at: "2026-11-01T13:18:01+00:00"
first_seen_at: "2026-11-01T13:20:07+00:00"
updated_at: "2026-11-01T13:21:53+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-120307", "first_seen_at": "2026-11-01T13:20:07+00:00"}]
---

# Beta9 worker: sandbox file API reads and writes host files as root

The Beta9 worker's sandbox file API turns container paths into host paths without confining them, so a tenant can escape the sandbox. An attacker with a workspace token and one running sandbox can read, write, list and delete files on the worker as root, including other tenants' files and the worker pod's Kubernetes service account token.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the worker version; affected builds are before `0.1.756`.
- Confirm whether the worker runs on shared hosts with other tenants' sandboxes.
- Check whether the worker's Kubernetes service account is bound to cluster-admin in the remote-node manifests.

## Fix

- Beta9 worker: move to `0.1.756` or later.

## Timeline

- 2026-11-01T13:20:07+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-120307

## From the sources

The Beta9 worker serves the sandbox file API from outside the container. getHostPathFromContainerPath turns the tenant's container path into a worker path. If the unresolved path starts with a mount destination, including the default upload mount at /tmp/.beta9, the remainder is joined onto that mount's source with filepath.Join, which cleans parent-directory segments after the prefix check. A long enough run of those segments names any absolute path on the worker. A path that matches no mount is joined onto the container root and opened in the worker's own filesystem, so an absolute symbolic link such as /var/run pointing at /run is followed against the worker root. Upload, download, stat, list, find-in-files, replace-in-files, and delete-file all call this helper. A tenant with a workspace token and one running sandbox can read, write, list, and delete files on the hosting worker as root, including files of other tenants on that machine. A read-only proof downloaded the worker pod's Kubernetes service account token through the file API for a path that did not exist inside the sandbox. In the shipped remote-node manifests that service account is bound to cluster-admin. Fixed in worker 0.1.756: sandbox file operations and workspace sync open paths with os.OpenRoot, so parent-directory and symlink lookups stay inside the container root or the mount source.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_