IT SBIT Services
Schneeberger
DEEN
CVE tracker

Beta9 worker: Sandbox escape via chroot-only build isolation

CVE-2026-120306Critical 9.9

← All vulnerabilities

Summary

The Beta9 worker runs tenant image builds with Buildah in chroot isolation, so build steps keep the worker pod's PID, IPC, network and user namespaces. The build runs as root with CAP_DAC_OVERRIDE, and the worker filesystem, including runc, the worker's Kubernetes service account token and mounted host directories, can be reached through /proc/1/root. A tenant with a workspace token can exploit this by submitting a single image build, which can lead to a full compromise of the worker, with a high impact on confidentiality, integrity and availability.

Affected

  • beam-cloud Beta9 worker versions before 0.1.756
  • Default configuration (Clip v2 layered builds) is affected.

Fixed in

  • Beta9 worker 0.1.756 and later (commit a28bf12, pull request 1897)
  • Vendor release listings show later worker builds; deploy the most recent release.

Workaround

Unknown.

Exploitation

  • OffSeq reports no known exploitation at the time of research.
  • No CISA KEV entry, public proof of concept or vendor advisory was found.
  • The attack requires only a tenant workspace token.

Our recommendation

  • Upgrade Beta9 workers to 0.1.756 or later, preferably the latest release.
  • Until the upgrade is done, limit which tenants hold workspace tokens and can submit image builds.
  • Treat worker nodes as sensitive: review service account permissions and host mounts.
  • Check whether other shared-tenant issues of the same batch (CVE-2026-120307, CVE-2026-120308) apply to your deployment.

Public exploits

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 14:20.

Original description (NVD)

Beta9 turns each shell command in a tenant image definition into a Dockerfile RUN line and executes it with Buildah on the build worker. The worker image sets BUILDAH_ISOLATION=chroot, and no buildah invocation passes --isolation, so the step only changes its filesystem root. It keeps the worker pod's PID, network, IPC, and user namespaces, runs as uid 0, and holds CAP_DAC_OVERRIDE. PID 1 in that procfs is the worker entrypoint, so /proc/1/root is the worker container's filesystem and is writable. That filesystem contains the runc, buildah, and runsc binaries the worker uses to start tenant containers, the worker's Kubernetes service account token, and the host directories mounted into the pod. Worker pods are privileged. Clip v2 layered builds are the default, so a tenant with a workspace token reaches this by submitting one image build. The read-only proof confirmed the shared namespaces, CAP_DAC_OVERRIDE, and that the worker's runc binary is visible at /proc/1/root. Fixed in worker 0.1.756: Buildah RUN steps, including the WORKDIR mkdir, use OCI isolation with private PID, IPC, and network namespaces, and tenant ARG values are passed only into the build container.

NVD references (4)

Sources

The tracker combines official, freely usable data sources – updated continuously:

This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touchRSS feed