{"id":"CVE-2026-120307","published":"2026-11-01T13:18:01.497","lastModified":"2026-11-01T13:18:01.497","description":"The Beta9 worker serves the sandbox file API from outside the container. getHostPathFromContainerPath turns the tenant's container path into a worker path. If the unresolved path starts with a mount destination, including the default upload mount at /tmp/.beta9, the remainder is joined onto that mount's source with filepath.Join, which cleans parent-directory segments after the prefix check. A long enough run of those segments names any absolute path on the worker. A path that matches no mount is joined onto the container root and opened in the worker's own filesystem, so an absolute symbolic link such as /var/run pointing at /run is followed against the worker root. Upload, download, stat, list, find-in-files, replace-in-files, and delete-file all call this helper. A tenant with a workspace token and one running sandbox can read, write, list, and delete files on the hosting worker as root, including files of other tenants on that machine. A read-only proof downloaded the worker pod's Kubernetes service account token through the file API for a path that did not exist inside the sandbox. In the shipped remote-node manifests that service account is bound to cluster-admin. Fixed in worker 0.1.756: sandbox file operations and workspace sync open paths with os.OpenRoot, so parent-directory and symlink lookups stay inside the container root or the mount source.","cvssScore":9.9,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cwes":["CWE-22","CWE-23","CWE-59"],"vendors":[],"products":[],"references":[{"url":"https://github.com/beam-cloud/beta9","tags":[]},{"url":"https://github.com/beam-cloud/beta9/commit/a28bf12cf0007c792a25d8ed282b4e8bf6f30393","tags":[]},{"url":"https://github.com/beam-cloud/beta9/pull/1897","tags":[]},{"url":"https://github.com/beam-cloud/beta9/releases/tag/worker-0.1.756","tags":[]}],"exploitRefs":[{"url":"https://github.com/beam-cloud/beta9","tags":[]},{"url":"https://github.com/beam-cloud/beta9/commit/a28bf12cf0007c792a25d8ed282b4e8bf6f30393","tags":[]},{"url":"https://github.com/beam-cloud/beta9/pull/1897","tags":[]},{"url":"https://github.com/beam-cloud/beta9/releases/tag/worker-0.1.756","tags":[]}],"hasPoc":true,"ai":{"summary":"The Beta9 worker's file API incorrectly resolves container paths to host paths, allowing a tenant with a workspace token and one running sandbox to escape the container and read, write, list, or delete arbitrary files on the worker host as root, including other tenants' data and sensitive host files like Kubernetes service account tokens.","exploitability":"Exploitation requires only a valid workspace token and one active sandbox; no user interaction or special privileges beyond the tenant's normal access.","blast_radius":"An attacker can compromise the entire worker node, exfiltrate credentials for cluster-wide access, and pivot to other tenants' workloads on the same host.","remediation":"Upgrade Beta9 worker to version 0.1.756 or later, which fixes the issue by using os.OpenRoot for sandbox file operations to prevent path traversal beyond the container root or mount source.","detection":"Look for unexpected access to sensitive host paths such as /var/run/secrets/kubernetes.io/serviceaccount/token or other non-sandbox files via the worker's file API logs; anomalous file operations (e.g., stat, read) targeting paths outside expected sandbox or mount directories may indicate exploitation.","tags":["container-escape","path-traversal","privilege-escalation","kubernetes-exposure","file-api-abuse"],"model":"garnet-coder","analyzedAt":"2026-11-02T09:48:31.418Z"}}