IT SBIT Services
Schneeberger
DEEN
CVE tracker

Beta9 worker: Path traversal in sandbox file API leads to container escape

CVE-2026-120307Critical 9.9

← All vulnerabilities

Summary

The Beta9 worker serves the sandbox file API from outside the container and does not safely resolve tenant-supplied paths. A tenant with a workspace token and one running sandbox can read, write, list and delete files on the hosting worker as root, including files of other tenants. The record describes a read of the worker pod's Kubernetes service account token, which in the shipped remote-node manifests is bound to cluster-admin.

Affected

  • beam-cloud Beta9 worker versions before 0.1.756
  • Default configuration is unaffected only with fixed workers; no other version details were found.

Fixed in

  • Worker 0.1.756 (released 2026-09-15), commit a28bf12 / pull request 1897
  • Newer worker releases (0.1.757 to 0.1.759) exist according to the releases index; not verified.

Workaround

  • No vendor workaround found.
  • Limit which users hold workspace tokens and sandbox creation rights until patched.
  • Do not run tenant sandboxes on workers that also hold sensitive credentials.

Exploitation

  • Authentication required: a valid tenant workspace token and a running sandbox.
  • OffSeq reports the CVE as not known to be exploited.
  • No public proof of concept found.
  • CISA KEV status: not checked.

Our recommendation

  • If you self-host Beta9 with untrusted or multiple tenants, update the worker to 0.1.756 or later (latest release preferred).
  • Also update the gateway to 0.1.776 (see related CVE-2026-120308).
  • Review worker service account privileges and avoid cluster-admin bindings.
  • Check who holds workspace tokens and review sandbox file activity.
  • If you only use a hosted service, ask the provider for its patch status.

Public exploits

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 14:21.

Original description (NVD)

The Beta9 worker serves the sandbox file API from outside the container. getHostPathFromContainerPath turns the tenant's container path into a worker path. If the unresolved path starts with a mount destination, including the default upload mount at /tmp/.beta9, the remainder is joined onto that mount's source with filepath.Join, which cleans parent-directory segments after the prefix check. A long enough run of those segments names any absolute path on the worker. A path that matches no mount is joined onto the container root and opened in the worker's own filesystem, so an absolute symbolic link such as /var/run pointing at /run is followed against the worker root. Upload, download, stat, list, find-in-files, replace-in-files, and delete-file all call this helper. A tenant with a workspace token and one running sandbox can read, write, list, and delete files on the hosting worker as root, including files of other tenants on that machine. A read-only proof downloaded the worker pod's Kubernetes service account token through the file API for a path that did not exist inside the sandbox. In the shipped remote-node manifests that service account is bound to cluster-admin. Fixed in worker 0.1.756: sandbox file operations and workspace sync open paths with os.OpenRoot, so parent-directory and symlink lookups stay inside the container root or the mount source.

NVD references (4)

Sources

The tracker combines official, freely usable data sources – updated continuously:

This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touchRSS feed