Live › vulnerability › CVE-2026-120308
A workspace token holder can attach a volume by supplying a crafted identifier with parent-directory segments, so the worker bind-mounts the host filesystem root into the sandbox. The attacker can then read and write the worker's files, including other tenants' volumes on that machine.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-01 13:20 UTC. All times on this page are UTC.
Teams running self-hosted Beta9 gateways and workers in a multi-tenant setup, where more than one workspace shares the same worker machines. The fix validates volume identifiers and mount paths before a mount is built, including for stubs saved before the check existed. Single-tenant deployments with only trusted workspace tokens face less risk, though the fix still applies.
No product ranges from the sources yet.
0.1.776.0.1.756... segments.0.1.776 or later.0.1.756 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A Beta9 tenant can attach a volume when deploying a function, endpoint, or task queue. The gateway builds the host path by joining the shared volumes root, the workspace name, and the volume identifier from the stub configuration. Nothing checks that the identifier names a volume that workspace owns. Parent-directory segments in the identifier collapse the joined path to the worker's filesystem root, and the worker bind-mounts that path into the sandbox read-write unless the volume was explicitly marked read-only. A tenant with a workspace token can therefore read and write the worker's files, including other tenants' volumes stored on that machine. Confirmed against gateway 0.1.769 and worker 0.1.745. Fixed in gateway 0.1.776 and worker 0.1.756: volume identifiers and mount paths are validated before a mount is built, including for stubs saved before the check existed, and the gateway rejects a volume that does not exist or is not owned by the workspace.
This page as .md · .json · in your agent: get_signal("CVE-2026-120308")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.