---
id: "CVE-2026-120308"
kind: "vulnerability"
aliases: ["CVE-2026-120308"]
title: "Beta9: tenant can mount host paths and read other tenants' files"
severity: "critical"
cvss: 9.9
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["beta9", "multi-tenant", "package", "self-hosted", "workers"]
not_affected_if: ["managed-hosting", "single-tenant-deployment"]
published_at: "2026-11-01T13:18:01+00:00"
first_seen_at: "2026-11-01T13:20:07+00:00"
updated_at: "2026-11-01T13:21:52+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-120308", "first_seen_at": "2026-11-01T13:20:07+00:00"}]
---

# Beta9: tenant can mount host paths and read other tenants' files

A workspace token holder can attach a volume by supplying a crafted identifier with parent-directory segments, so the worker bind-mounts the host filesystem root into the sandbox. The attacker can then read and write the worker's files, including other tenants' volumes on that machine.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the gateway version and confirm it is below `0.1.776`.
- Check the worker version and confirm it is below `0.1.756`.
- Review stub configurations for volume identifiers containing `..` segments.

## Fix

- Gateway: move to `0.1.776` or later.
- Worker: move to `0.1.756` or later.

## Timeline

- 2026-11-01T13:20:07+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-120308

## From the sources

A Beta9 tenant can attach a volume when deploying a function, endpoint, or task queue. The gateway builds the host path by joining the shared volumes root, the workspace name, and the volume identifier from the stub configuration. Nothing checks that the identifier names a volume that workspace owns. Parent-directory segments in the identifier collapse the joined path to the worker's filesystem root, and the worker bind-mounts that path into the sandbox read-write unless the volume was explicitly marked read-only. A tenant with a workspace token can therefore read and write the worker's files, including other tenants' volumes stored on that machine. Confirmed against gateway 0.1.769 and worker 0.1.745. Fixed in gateway 0.1.776 and worker 0.1.756: volume identifiers and mount paths are validated before a mount is built, including for stubs saved before the check existed, and the gateway rejects a volume that does not exist or is not owned by the workspace.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_