{"id":"CVE-2026-120308","kind":"vulnerability","aliases":["CVE-2026-120308"],"related":[],"title":"Beta9: tenant can mount host paths and read other tenants' files","description":"A Beta9 tenant can attach a volume when deploying a function, endpoint, or task queue. The gateway builds the host path by joining the shared volumes root, the workspace name, and the volume identifier from the stub configuration. Nothing checks that the identifier names a volume that workspace owns. Parent-directory segments in the identifier collapse the joined path to the worker's filesystem root, and the worker bind-mounts that path into the sandbox read-write unless the volume was explicitly marked read-only. A tenant with a workspace token can therefore read and write the worker's files, including other tenants' volumes stored on that machine. Confirmed against gateway 0.1.769 and worker 0.1.745. Fixed in gateway 0.1.776 and worker 0.1.756: volume identifiers and mount paths are validated before a mount is built, including for stubs saved before the check existed, and the gateway rejects a volume that does not exist or is not owned by the workspace.","summary":"A workspace token holder can attach a volume by supplying a crafted identifier with parent-directory segments, so the worker bind-mounts the host filesystem root into the sandbox. The attacker can then read and write the worker's files, including other tenants' volumes on that machine.","severity":"critical","cvss":9.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["beta9","multi-tenant","package","self-hosted","workers"],"not_affected_if":["managed-hosting","single-tenant-deployment"],"how_to_check":"- Check the gateway version and confirm it is below `0.1.776`.\n- Check the worker version and confirm it is below `0.1.756`.\n- Review stub configurations for volume identifiers containing `..` segments.","fix":"- Gateway: move to `0.1.776` or later.\n- Worker: move to `0.1.756` or later.","status":"open","published_at":"2026-11-01T13:18:01+00:00","first_seen_at":"2026-11-01T13:20:07+00:00","triaged_at":"2026-11-01T13:21:52+00:00","updated_at":"2026-11-01T13:21:52+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-01T13:21:52Z","model":"claude-haiku-5-5","output":{"fix":"- Gateway: move to `0.1.776` or later.\n- Worker: move to `0.1.756` or later.","reach":"network","title":"Beta9: tenant can mount host paths and read other tenants' files","impact":"high","summary":"A workspace token holder can attach a volume by supplying a crafted identifier with parent-directory segments, so the worker bind-mounts the host filesystem root into the sandbox. The attacker can then read and write the worker's files, including other tenants' volumes on that machine.","audience":"businesses","category":"package","nicknames":[],"who_cares":["beta9","self-hosted","multi-tenant","workers"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"Tenant reads and writes worker files, including other tenants' volumes.","analyst_note":"","how_to_check":"- Check the gateway version and confirm it is below `0.1.776`.\n- Check the worker version and confirm it is below `0.1.756`.\n- Review stub configurations for volume identifiers containing `..` segments.","plain_action":"","needs_analyst":false,"not_affected_if":["single-tenant-deployment","managed-hosting"],"who_is_affected":"Teams running self-hosted Beta9 gateways and workers in a multi-tenant setup, where more than one workspace shares the same worker machines. The fix validates volume identifiers and mount paths before a mount is built, including for stubs saved before the check existed. Single-tenant deployments with only trusted workspace tokens face less risk, though the fix still applies.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.00072,"input_tokens":4333,"output_tokens":573,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-120308':14A,17A '-2026':13A,16A '0.1.745':194C '0.1.756':201C '0.1.769':191C '0.1.776':198C 'attach':32B,80C 'attack':59B 'beta9':1A,18B,77C 'bind':49B,146C 'bind-mount':48B,145C 'build':93C 'built':213C 'check':115C,220C 'collaps':132C 'configur':113C 'confirm':188C 'craft':38B 'cve':12A,15A 'deploy':84C 'directori':43B,127C 'endpoint':87C 'exist':221C,231C 'explicit':160C 'file':11A,68B,179C 'filesystem':53B,140C 'fix':195C 'function':86C 'gateway':92C,190C,197C,224C 'holder':30B 'host':5A,25B,52B,95C 'identifi':39B,109C,118C,131C,203C 'includ':69B,180C,214C 'join':98C,134C 'machin':75B,187C 'mark':161C 'mount':4A,50B,147C,205C,211C 'multi':20B 'multi-ten':19B 'name':105C,119C 'noth':114C 'own':124C,235C 'packag':22B 'parent':42B,126C 'parent-directori':41B,125C 'path':6A,96C,135C,149C,206C 'queue':90C 'read':8A,62B,154C,163C,173C 'read-on':162C 'read-writ':153C 'reject':225C 'root':54B,102C,141C 'sandbox':57B,152C 'save':217C 'segment':44B,128C 'self':24B 'self-host':23B 'share':100C 'store':184C 'stub':112C,216C 'suppli':36B 'task':89C 'tenant':2A,10A,21B,71B,78C,166C,182C 'therefor':172C 'token':29B,170C 'unless':156C 'valid':208C 'volum':34B,72B,82C,101C,108C,121C,158C,183C,202C,227C 'worker':26B,47B,66B,138C,144C,177C,193C,200C 'workspac':28B,104C,123C,169C,238C 'write':64B,155C,175C","nicknames":[],"mitigations":[],"who_affected":"Teams running self-hosted Beta9 gateways and workers in a multi-tenant setup, where more than one workspace shares the same worker machines. The fix validates volume identifiers and mount paths before a mount is built, including for stubs saved before the check existed. Single-tenant deployments with only trusted workspace tokens face less risk, though the fix still applies.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-11-01T13:18:01+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cvss_by":"reefs@jfrog.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120308","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120308","severity":null,"published_at":"2026-11-01T13:18:01+00:00","modified_at":"2026-11-01T13:18:01+00:00","first_seen_at":"2026-11-01T13:20:07+00:00","fetched_at":"2026-11-01T13:20:07+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}