Beta9: Path traversal in volume handling exposes worker host filesystem
Summary
Beta9 gateway and worker builds before 0.1.776 and 0.1.756 do not validate volume identifiers when a function, endpoint or task queue is deployed. A tenant with a valid workspace token can use parent-directory segments to make the mount path point to the worker's filesystem root. The worker then bind-mounts that path read-write into the sandbox unless the volume is marked read-only. This allows reading and writing files on the worker, including other tenants' volumes stored on the same machine.
Affected
- beam-cloud Beta9 gateway before 0.1.776 (confirmed vulnerable: 0.1.769)
- beam-cloud Beta9 worker before 0.1.756 (confirmed vulnerable: 0.1.745)
- Self-hosted and managed deployments are affected according to the vendor record; managed customers should confirm with Beam.
Fixed in
- Gateway 0.1.776 or later
- Worker 0.1.756 or later
- Fix commit a28bf12 (pull request 1897), released 2026-09-15
- Newer release gateway 0.1.820 exists; its release notes do not state whether it includes the fix, so the latest release is recommended.
Workaround
Unknown.
- Limit which users hold workspace tokens.
- Review existing stubs for volume identifiers containing parent-directory segments.
- Mark volumes as read-only where possible; this limits write impact but read access may remain.
Exploitation
- Exploited in the wild: No evidence found at the time of writing.
- Public proof of concept: Unknown.
- The attacker needs a valid workspace token (CVSS PR:L, no user interaction).
Our recommendation
- Identify all Beta9 gateways and workers and their versions.
- Upgrade the gateway to at least 0.1.776 and the worker to at least 0.1.756, preferably the latest release.
- Audit workspace tokens and stubs that mount volumes; revoke unneeded tokens.
- Check whether shared workers host volumes of several tenants or teams.
- Re-check once the GitHub advisory and NVD analysis are published.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Fix commit a28bf12 (beta9) github.com
- Pull request 1897 (beta9) github.com
- Gateway release 0.1.776 github.com
- Worker release 0.1.756 github.com
- Gateway release 0.1.769 github.com
- Worker release 0.1.745 github.com
- Beta9 repository github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 14:21.
Original description (NVD)
A Beta9 tenant can attach a volume when deploying a function, endpoint, or task queue. The gateway builds the host path by joining the shared volumes root, the workspace name, and the volume identifier from the stub configuration. Nothing checks that the identifier names a volume that workspace owns. Parent-directory segments in the identifier collapse the joined path to the worker's filesystem root, and the worker bind-mounts that path into the sandbox read-write unless the volume was explicitly marked read-only. A tenant with a workspace token can therefore read and write the worker's files, including other tenants' volumes stored on that machine. Confirmed against gateway 0.1.769 and worker 0.1.745. Fixed in gateway 0.1.776 and worker 0.1.756: volume identifiers and mount paths are validated before a mount is built, including for stubs saved before the check existed, and the gateway rejects a volume that does not exist or is not owned by the workspace.
NVD references (7)
- https://github.com/beam-cloud/beta9
- https://github.com/beam-cloud/beta9/commit/a28bf12cf0007c792a25d8ed282b4e8bf6f30393
- https://github.com/beam-cloud/beta9/pull/1897
- https://github.com/beam-cloud/beta9/releases/tag/gateway-0.1.769
- https://github.com/beam-cloud/beta9/releases/tag/gateway-0.1.776
- https://github.com/beam-cloud/beta9/releases/tag/worker-0.1.745
- https://github.com/beam-cloud/beta9/releases/tag/worker-0.1.756
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.