Find a vulnerability

{
  "containers": {
    "cna": {
      "affected": [
        {
          "collectionURL": "https://github.com/beam-cloud/beta9/releases",
          "defaultStatus": "unaffected",
          "packageName": "github.com/beam-cloud/beta9",
          "product": "Beta9 gateway",
          "programFiles": [
            "pkg/abstractions/common/mount.go",
            "pkg/gateway/services/stub.go"
          ],
          "repo": "git://github.com/beam-cloud/beta9",
          "vendor": "beam-cloud",
          "versions": [
            {
              "lessThan": "0.1.776",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://github.com/beam-cloud/beta9/releases",
          "defaultStatus": "unaffected",
          "packageName": "github.com/beam-cloud/beta9",
          "product": "Beta9 worker",
          "programFiles": [
            "pkg/abstractions/common/mount.go",
            "pkg/worker/lifecycle.go"
          ],
          "repo": "git://github.com/beam-cloud/beta9",
          "vendor": "beam-cloud",
          "versions": [
            {
              "lessThan": "0.1.756",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Natan Nehorai"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "JFrog Security Research"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eA Beta9 tenant can attach a volume when deploying a function, endpoint, or task queue. The gateway builds the host path by joining the shared volumes root, the workspace name, and the volume identifier from the stub configuration. Nothing checks that the identifier names a volume that workspace owns. Parent-directory segments in the identifier collapse the joined path to the worker\u0027s filesystem root, and the worker bind-mounts that path into the sandbox read-write unless the volume was explicitly marked read-only. A tenant with a workspace token can therefore read and write the worker\u0027s files, including other tenants\u0027 volumes stored on that machine. Confirmed against gateway 0.1.769 and worker 0.1.745. Fixed in gateway 0.1.776 and worker 0.1.756: volume identifiers and mount paths are validated before a mount is built, including for stubs saved before the check existed, and the gateway rejects a volume that does not exist or is not owned by the workspace.\u003c/p\u003e"
            }
          ],
          "value": "A Beta9 tenant can attach a volume when deploying a function, endpoint, or task queue. The gateway builds the host path by joining the shared volumes root, the workspace name, and the volume identifier from the stub configuration. Nothing checks that the identifier names a volume that workspace owns. Parent-directory segments in the identifier collapse the joined path to the worker\u0027s filesystem root, and the worker bind-mounts that path into the sandbox read-write unless the volume was explicitly marked read-only. A tenant with a workspace token can therefore read and write the worker\u0027s files, including other tenants\u0027 volumes stored on that machine. Confirmed against gateway 0.1.769 and worker 0.1.745. Fixed in gateway 0.1.776 and worker 0.1.756: volume identifiers and mount paths are validated before a mount is built, including for stubs saved before the check existed, and the gateway rejects a volume that does not exist or is not owned by the workspace."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.9,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "Tenant with a workspace token deploying a function that attaches a volume"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-668",
              "description": "CWE-668: Exposure of Resource to Wrong Sphere",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-01T12:51:50.481Z",
        "orgId": "48a46f29-ae42-4e1d-90dd-c1676c1e5e6d",
        "shortName": "JFROG"
      },
      "references": [
        {
          "name": "Beta9 repository",
          "tags": [
            "product"
          ],
          "url": "https://github.com/beam-cloud/beta9"
        },
        {
          "name": "Handle sandbox edge cases (fix pull request)",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/beam-cloud/beta9/pull/1897"
        },
        {
          "name": "Fix commit a28bf12",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/beam-cloud/beta9/commit/a28bf12cf0007c792a25d8ed282b4e8bf6f30393"
        },
        {
          "name": "gateway-0.1.776",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/beam-cloud/beta9/releases/tag/gateway-0.1.776"
        },
        {
          "name": "worker-0.1.756",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/beam-cloud/beta9/releases/tag/worker-0.1.756"
        },
        {
          "name": "gateway-0.1.769 (confirmed affected)",
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/beam-cloud/beta9/releases/tag/gateway-0.1.769"
        },
        {
          "name": "worker-0.1.745 (confirmed affected)",
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/beam-cloud/beta9/releases/tag/worker-0.1.745"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eUpgrade the gateway to 0.1.776 or later and the worker to 0.1.756 or later. Volume identifiers and mount paths are rejected when they are empty, \".\", \"..\", or contain a slash (identifiers) or a \"..\" segment (mount paths). The gateway also refuses a volume the workspace does not own. Stubs stored before the check existed are validated when they are launched. The fix is commit a28bf12 (pull request 1897), released on 2026-09-15.\u003c/p\u003e"
            }
          ],
          "value": "Upgrade the gateway to 0.1.776 or later and the worker to 0.1.756 or later. Volume identifiers and mount paths are rejected when they are empty, \".\", \"..\", or contain a slash (identifiers) or a \"..\" segment (mount paths). The gateway also refuses a volume the workspace does not own. Stubs stored before the check existed are validated when they are launched. The fix is commit a28bf12 (pull request 1897), released on 2026-09-15."
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "timeline": [
        {
          "lang": "en",
          "time": "2026-09-07T02:47:00.000Z",
          "value": "Confirmed affected releases worker-0.1.745 and gateway-0.1.769 are current"
        },
        {
          "lang": "en",
          "time": "2026-09-15T04:03:00.000Z",
          "value": "Fix merged in pull request 1897 (commit a28bf12)"
        },
        {
          "lang": "en",
          "time": "2026-09-15T04:04:00.000Z",
          "value": "Fixed releases worker-0.1.756 and gateway-0.1.776 published. No vendor security advisory was filed with the pull request."
        }
      ],
      "title": "Beta9 host filesystem exposure via volume path traversal",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "48a46f29-ae42-4e1d-90dd-c1676c1e5e6d",
    "assignerShortName": "JFROG",
    "cveId": "CVE-2026-120308",
    "datePublished": "2026-11-01T12:51:50.481Z",
    "dateReserved": "2026-11-01T12:46:51.095Z",
    "dateUpdated": "2026-11-01T12:51:50.481Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "collectionURL": "https://github.com/beam-cloud/beta9/releases",
          "defaultStatus": "unaffected",
          "packageName": "github.com/beam-cloud/beta9",
          "product": "Beta9 worker",
          "programFiles": [
            "pkg/worker/container_server.go",
            "pkg/worker/lifecycle.go",
            "pkg/types/worker.go"
          ],
          "repo": "git://github.com/beam-cloud/beta9",
          "vendor": "beam-cloud",
          "versions": [
            {
              "lessThan": "0.1.756",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Natan Nehorai"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "JFrog Security Research"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe Beta9 worker serves the sandbox file API from outside the container. getHostPathFromContainerPath turns the tenant\u0027s container path into a worker path. If the unresolved path starts with a mount destination, including the default upload mount at /tmp/.beta9, the remainder is joined onto that mount\u0027s source with filepath.Join, which cleans parent-directory segments after the prefix check. A long enough run of those segments names any absolute path on the worker. A path that matches no mount is joined onto the container root and opened in the worker\u0027s own filesystem, so an absolute symbolic link such as /var/run pointing at /run is followed against the worker root. Upload, download, stat, list, find-in-files, replace-in-files, and delete-file all call this helper. A tenant with a workspace token and one running sandbox can read, write, list, and delete files on the hosting worker as root, including files of other tenants on that machine. A read-only proof downloaded the worker pod\u0027s Kubernetes service account token through the file API for a path that did not exist inside the sandbox. In the shipped remote-node manifests that service account is bound to cluster-admin. Fixed in worker 0.1.756: sandbox file operations and workspace sync open paths with os.OpenRoot, so parent-directory and symlink lookups stay inside the container root or the mount source.\u003c/p\u003e"
            }
          ],
          "value": "The Beta9 worker serves the sandbox file API from outside the container. getHostPathFromContainerPath turns the tenant\u0027s container path into a worker path. If the unresolved path starts with a mount destination, including the default upload mount at /tmp/.beta9, the remainder is joined onto that mount\u0027s source with filepath.Join, which cleans parent-directory segments after the prefix check. A long enough run of those segments names any absolute path on the worker. A path that matches no mount is joined onto the container root and opened in the worker\u0027s own filesystem, so an absolute symbolic link such as /var/run pointing at /run is followed against the worker root. Upload, download, stat, list, find-in-files, replace-in-files, and delete-file all call this helper. A tenant with a workspace token and one running sandbox can read, write, list, and delete files on the hosting worker as root, including files of other tenants on that machine. A read-only proof downloaded the worker pod\u0027s Kubernetes service account token through the file API for a path that did not exist inside the sandbox. In the shipped remote-node manifests that service account is bound to cluster-admin. Fixed in worker 0.1.756: sandbox file operations and workspace sync open paths with os.OpenRoot, so parent-directory and symlink lookups stay inside the container root or the mount source."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.9,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "Tenant with a workspace token and a running sandbox on a worker that serves the sandbox file API"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-23",
              "description": "CWE-23: Relative Path Traversal",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-59",
              "description": "CWE-59: Improper Link Resolution Before File Access (\u0027Link Following\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-01T12:49:51.981Z",
        "orgId": "48a46f29-ae42-4e1d-90dd-c1676c1e5e6d",
        "shortName": "JFROG"
      },
      "references": [
        {
          "name": "Beta9 repository",
          "tags": [
            "product"
          ],
          "url": "https://github.com/beam-cloud/beta9"
        },
        {
          "name": "Handle sandbox edge cases (fix pull request)",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/beam-cloud/beta9/pull/1897"
        },
        {
          "name": "Fix commit a28bf12",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/beam-cloud/beta9/commit/a28bf12cf0007c792a25d8ed282b4e8bf6f30393"
        },
        {
          "name": "worker-0.1.756",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/beam-cloud/beta9/releases/tag/worker-0.1.756"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eUpgrade the Beta9 worker to 0.1.756 or later. Sandbox file APIs and workspace sync use os.OpenRoot, so parent-directory segments and symbolic links stay inside the container root or the mount source. File operations refuse read-only mounts and do not write through a symlink swapped in after path resolution. The fix is commit a28bf12 (pull request 1897), released as worker-0.1.756 on 2026-09-15.\u003c/p\u003e"
            }
          ],
          "value": "Upgrade the Beta9 worker to 0.1.756 or later. Sandbox file APIs and workspace sync use os.OpenRoot, so parent-directory segments and symbolic links stay inside the container root or the mount source. File operations refuse read-only mounts and do not write through a symlink swapped in after path resolution. The fix is commit a28bf12 (pull request 1897), released as worker-0.1.756 on 2026-09-15."
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "timeline": [
        {
          "lang": "en",
          "time": "2026-09-15T04:03:00.000Z",
          "value": "Fix merged in pull request 1897 (commit a28bf12)"
        },
        {
          "lang": "en",
          "time": "2026-09-15T04:03:00.000Z",
          "value": "Fixed release worker-0.1.756 published. No vendor security advisory was filed with the pull request."
        }
      ],
      "title": "Beta9 container escape via unvalidated sandbox file paths",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "48a46f29-ae42-4e1d-90dd-c1676c1e5e6d",
    "assignerShortName": "JFROG",
    "cveId": "CVE-2026-120307",
    "datePublished": "2026-11-01T12:49:51.981Z",
    "dateReserved": "2026-11-01T12:45:12.430Z",
    "dateUpdated": "2026-11-01T12:49:51.981Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "collectionURL": "https://github.com/beam-cloud/beta9/releases",
          "defaultStatus": "unaffected",
          "packageName": "github.com/beam-cloud/beta9",
          "product": "Beta9 worker",
          "programFiles": [
            "docker/Dockerfile.worker",
            "pkg/worker/image.go",
            "pkg/worker/image_build_layered.go",
            "pkg/abstractions/image/builder.go",
            "pkg/scheduler/pool_local.go"
          ],
          "repo": "git://github.com/beam-cloud/beta9",
          "vendor": "beam-cloud",
          "versions": [
            {
              "lessThan": "0.1.756",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Natan Nehorai"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "JFrog Security Research"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eBeta9 turns each shell command in a tenant image definition into a Dockerfile RUN line and executes it with Buildah on the build worker. The worker image sets BUILDAH_ISOLATION=chroot, and no buildah invocation passes --isolation, so the step only changes its filesystem root. It keeps the worker pod\u0027s PID, network, IPC, and user namespaces, runs as uid 0, and holds CAP_DAC_OVERRIDE. PID 1 in that procfs is the worker entrypoint, so /proc/1/root is the worker container\u0027s filesystem and is writable. That filesystem contains the runc, buildah, and runsc binaries the worker uses to start tenant containers, the worker\u0027s Kubernetes service account token, and the host directories mounted into the pod. Worker pods are privileged. Clip v2 layered builds are the default, so a tenant with a workspace token reaches this by submitting one image build. The read-only proof confirmed the shared namespaces, CAP_DAC_OVERRIDE, and that the worker\u0027s runc binary is visible at /proc/1/root. Fixed in worker 0.1.756: Buildah RUN steps, including the WORKDIR mkdir, use OCI isolation with private PID, IPC, and network namespaces, and tenant ARG values are passed only into the build container.\u003c/p\u003e"
            }
          ],
          "value": "Beta9 turns each shell command in a tenant image definition into a Dockerfile RUN line and executes it with Buildah on the build worker. The worker image sets BUILDAH_ISOLATION=chroot, and no buildah invocation passes --isolation, so the step only changes its filesystem root. It keeps the worker pod\u0027s PID, network, IPC, and user namespaces, runs as uid 0, and holds CAP_DAC_OVERRIDE. PID 1 in that procfs is the worker entrypoint, so /proc/1/root is the worker container\u0027s filesystem and is writable. That filesystem contains the runc, buildah, and runsc binaries the worker uses to start tenant containers, the worker\u0027s Kubernetes service account token, and the host directories mounted into the pod. Worker pods are privileged. Clip v2 layered builds are the default, so a tenant with a workspace token reaches this by submitting one image build. The read-only proof confirmed the shared namespaces, CAP_DAC_OVERRIDE, and that the worker\u0027s runc binary is visible at /proc/1/root. Fixed in worker 0.1.756: Buildah RUN steps, including the WORKDIR mkdir, use OCI isolation with private PID, IPC, and network namespaces, and tenant ARG values are passed only into the build container."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.9,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "Default clip v2 layered image build on a privileged build-pool worker"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-653",
              "description": "CWE-653: Improper Isolation or Compartmentalization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-269",
              "description": "CWE-269: Improper Privilege Management",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-01T12:49:05.857Z",
        "orgId": "48a46f29-ae42-4e1d-90dd-c1676c1e5e6d",
        "shortName": "JFROG"
      },
      "references": [
        {
          "name": "Beta9 repository",
          "tags": [
            "product"
          ],
          "url": "https://github.com/beam-cloud/beta9"
        },
        {
          "name": "Handle sandbox edge cases (fix pull request)",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/beam-cloud/beta9/pull/1897"
        },
        {
          "name": "Fix commit a28bf12",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/beam-cloud/beta9/commit/a28bf12cf0007c792a25d8ed282b4e8bf6f30393"
        },
        {
          "name": "worker-0.1.756",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/beam-cloud/beta9/releases/tag/worker-0.1.756"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eUpgrade the Beta9 worker to 0.1.756 or later. That release drops chroot isolation: Buildah RUN steps use OCI isolation with private PID, IPC, and network namespaces, and tenant build arguments are applied inside the build container rather than in the Buildah process environment. The fix is commit a28bf12 (pull request 1897), released as worker-0.1.756 on 2026-09-15. Gateway 0.1.776 is the gateway tag cut from the same commit; the isolation change itself is in the worker image.\u003c/p\u003e"
            }
          ],
          "value": "Upgrade the Beta9 worker to 0.1.756 or later. That release drops chroot isolation: Buildah RUN steps use OCI isolation with private PID, IPC, and network namespaces, and tenant build arguments are applied inside the build container rather than in the Buildah process environment. The fix is commit a28bf12 (pull request 1897), released as worker-0.1.756 on 2026-09-15. Gateway 0.1.776 is the gateway tag cut from the same commit; the isolation change itself is in the worker image."
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "timeline": [
        {
          "lang": "en",
          "time": "2026-09-15T04:03:00.000Z",
          "value": "Fix merged in pull request 1897 (commit a28bf12)"
        },
        {
          "lang": "en",
          "time": "2026-09-15T04:03:00.000Z",
          "value": "Fixed release worker-0.1.756 published. No vendor security advisory was filed with the pull request."
        }
      ],
      "title": "Beta9 build sandbox escape via chroot-only isolation",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "48a46f29-ae42-4e1d-90dd-c1676c1e5e6d",
    "assignerShortName": "JFROG",
    "cveId": "CVE-2026-120306",
    "datePublished": "2026-11-01T12:49:05.857Z",
    "dateReserved": "2026-11-01T12:32:40.057Z",
    "dateUpdated": "2026-11-01T12:49:05.857Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "collectionURL": "https://github.com/beam-cloud/beta9/releases",
          "defaultStatus": "unaffected",
          "packageName": "github.com/beam-cloud/beta9",
          "product": "Beta9 gateway",
          "programFiles": [
            "pkg/abstractions/common/mount.go",
            "pkg/gateway/services/stub.go"
          ],
          "repo": "git://github.com/beam-cloud/beta9",
          "vendor": "beam-cloud",
          "versions": [
            {
              "lessThan": "0.1.776",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://github.com/beam-cloud/beta9/releases",
          "defaultStatus": "unaffected",
          "packageName": "github.com/beam-cloud/beta9",
          "product": "Beta9 worker",
          "programFiles": [
            "pkg/abstractions/common/mount.go",
            "pkg/worker/lifecycle.go"
          ],
          "repo": "git://github.com/beam-cloud/beta9",
          "vendor": "beam-cloud",
          "versions": [
            {
              "lessThan": "0.1.756",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Natan Nehorai"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "JFrog Security Research"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eA Beta9 tenant can attach a volume when deploying a function, endpoint, or task queue. The gateway builds the host path by joining the shared volumes root, the workspace name, and the volume identifier from the stub configuration. Nothing checks that the identifier names a volume that workspace owns. Parent-directory segments in the identifier collapse the joined path to the worker\u0027s filesystem root, and the worker bind-mounts that path into the sandbox read-write unless the volume was explicitly marked read-only. A tenant with a workspace token can therefore read and write the worker\u0027s files, including other tenants\u0027 volumes stored on that machine. Confirmed against gateway 0.1.769 and worker 0.1.745. Fixed in gateway 0.1.776 and worker 0.1.756: volume identifiers and mount paths are validated before a mount is built, including for stubs saved before the check existed, and the gateway rejects a volume that does not exist or is not owned by the workspace.\u003c/p\u003e"
            }
          ],
          "value": "A Beta9 tenant can attach a volume when deploying a function, endpoint, or task queue. The gateway builds the host path by joining the shared volumes root, the workspace name, and the volume identifier from the stub configuration. Nothing checks that the identifier names a volume that workspace owns. Parent-directory segments in the identifier collapse the joined path to the worker\u0027s filesystem root, and the worker bind-mounts that path into the sandbox read-write unless the volume was explicitly marked read-only. A tenant with a workspace token can therefore read and write the worker\u0027s files, including other tenants\u0027 volumes stored on that machine. Confirmed against gateway 0.1.769 and worker 0.1.745. Fixed in gateway 0.1.776 and worker 0.1.756: volume identifiers and mount paths are validated before a mount is built, including for stubs saved before the check existed, and the gateway rejects a volume that does not exist or is not owned by the workspace."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.9,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "Tenant with a workspace token deploying a function that attaches a volume"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-668",
              "description": "CWE-668: Exposure of Resource to Wrong Sphere",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-01T12:51:50.481Z",
        "orgId": "48a46f29-ae42-4e1d-90dd-c1676c1e5e6d",
        "shortName": "JFROG"
      },
      "references": [
        {
          "name": "Beta9 repository",
          "tags": [
            "product"
          ],
          "url": "https://github.com/beam-cloud/beta9"
        },
        {
          "name": "Handle sandbox edge cases (fix pull request)",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/beam-cloud/beta9/pull/1897"
        },
        {
          "name": "Fix commit a28bf12",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/beam-cloud/beta9/commit/a28bf12cf0007c792a25d8ed282b4e8bf6f30393"
        },
        {
          "name": "gateway-0.1.776",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/beam-cloud/beta9/releases/tag/gateway-0.1.776"
        },
        {
          "name": "worker-0.1.756",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/beam-cloud/beta9/releases/tag/worker-0.1.756"
        },
        {
          "name": "gateway-0.1.769 (confirmed affected)",
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/beam-cloud/beta9/releases/tag/gateway-0.1.769"
        },
        {
          "name": "worker-0.1.745 (confirmed affected)",
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/beam-cloud/beta9/releases/tag/worker-0.1.745"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eUpgrade the gateway to 0.1.776 or later and the worker to 0.1.756 or later. Volume identifiers and mount paths are rejected when they are empty, \".\", \"..\", or contain a slash (identifiers) or a \"..\" segment (mount paths). The gateway also refuses a volume the workspace does not own. Stubs stored before the check existed are validated when they are launched. The fix is commit a28bf12 (pull request 1897), released on 2026-09-15.\u003c/p\u003e"
            }
          ],
          "value": "Upgrade the gateway to 0.1.776 or later and the worker to 0.1.756 or later. Volume identifiers and mount paths are rejected when they are empty, \".\", \"..\", or contain a slash (identifiers) or a \"..\" segment (mount paths). The gateway also refuses a volume the workspace does not own. Stubs stored before the check existed are validated when they are launched. The fix is commit a28bf12 (pull request 1897), released on 2026-09-15."
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "timeline": [
        {
          "lang": "en",
          "time": "2026-09-07T02:47:00.000Z",
          "value": "Confirmed affected releases worker-0.1.745 and gateway-0.1.769 are current"
        },
        {
          "lang": "en",
          "time": "2026-09-15T04:03:00.000Z",
          "value": "Fix merged in pull request 1897 (commit a28bf12)"
        },
        {
          "lang": "en",
          "time": "2026-09-15T04:04:00.000Z",
          "value": "Fixed releases worker-0.1.756 and gateway-0.1.776 published. No vendor security advisory was filed with the pull request."
        }
      ],
      "title": "Beta9 host filesystem exposure via volume path traversal",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "48a46f29-ae42-4e1d-90dd-c1676c1e5e6d",
    "assignerShortName": "JFROG",
    "cveId": "CVE-2026-120308",
    "datePublished": "2026-11-01T12:51:50.481Z",
    "dateReserved": "2026-11-01T12:46:51.095Z",
    "dateUpdated": "2026-11-01T12:51:50.481Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "collectionURL": "https://github.com/beam-cloud/beta9/releases",
          "defaultStatus": "unaffected",
          "packageName": "github.com/beam-cloud/beta9",
          "product": "Beta9 worker",
          "programFiles": [
            "pkg/worker/container_server.go",
            "pkg/worker/lifecycle.go",
            "pkg/types/worker.go"
          ],
          "repo": "git://github.com/beam-cloud/beta9",
          "vendor": "beam-cloud",
          "versions": [
            {
              "lessThan": "0.1.756",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Natan Nehorai"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "JFrog Security Research"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe Beta9 worker serves the sandbox file API from outside the container. getHostPathFromContainerPath turns the tenant\u0027s container path into a worker path. If the unresolved path starts with a mount destination, including the default upload mount at /tmp/.beta9, the remainder is joined onto that mount\u0027s source with filepath.Join, which cleans parent-directory segments after the prefix check. A long enough run of those segments names any absolute path on the worker. A path that matches no mount is joined onto the container root and opened in the worker\u0027s own filesystem, so an absolute symbolic link such as /var/run pointing at /run is followed against the worker root. Upload, download, stat, list, find-in-files, replace-in-files, and delete-file all call this helper. A tenant with a workspace token and one running sandbox can read, write, list, and delete files on the hosting worker as root, including files of other tenants on that machine. A read-only proof downloaded the worker pod\u0027s Kubernetes service account token through the file API for a path that did not exist inside the sandbox. In the shipped remote-node manifests that service account is bound to cluster-admin. Fixed in worker 0.1.756: sandbox file operations and workspace sync open paths with os.OpenRoot, so parent-directory and symlink lookups stay inside the container root or the mount source.\u003c/p\u003e"
            }
          ],
          "value": "The Beta9 worker serves the sandbox file API from outside the container. getHostPathFromContainerPath turns the tenant\u0027s container path into a worker path. If the unresolved path starts with a mount destination, including the default upload mount at /tmp/.beta9, the remainder is joined onto that mount\u0027s source with filepath.Join, which cleans parent-directory segments after the prefix check. A long enough run of those segments names any absolute path on the worker. A path that matches no mount is joined onto the container root and opened in the worker\u0027s own filesystem, so an absolute symbolic link such as /var/run pointing at /run is followed against the worker root. Upload, download, stat, list, find-in-files, replace-in-files, and delete-file all call this helper. A tenant with a workspace token and one running sandbox can read, write, list, and delete files on the hosting worker as root, including files of other tenants on that machine. A read-only proof downloaded the worker pod\u0027s Kubernetes service account token through the file API for a path that did not exist inside the sandbox. In the shipped remote-node manifests that service account is bound to cluster-admin. Fixed in worker 0.1.756: sandbox file operations and workspace sync open paths with os.OpenRoot, so parent-directory and symlink lookups stay inside the container root or the mount source."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.9,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "Tenant with a workspace token and a running sandbox on a worker that serves the sandbox file API"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-23",
              "description": "CWE-23: Relative Path Traversal",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-59",
              "description": "CWE-59: Improper Link Resolution Before File Access (\u0027Link Following\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-01T12:49:51.981Z",
        "orgId": "48a46f29-ae42-4e1d-90dd-c1676c1e5e6d",
        "shortName": "JFROG"
      },
      "references": [
        {
          "name": "Beta9 repository",
          "tags": [
            "product"
          ],
          "url": "https://github.com/beam-cloud/beta9"
        },
        {
          "name": "Handle sandbox edge cases (fix pull request)",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/beam-cloud/beta9/pull/1897"
        },
        {
          "name": "Fix commit a28bf12",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/beam-cloud/beta9/commit/a28bf12cf0007c792a25d8ed282b4e8bf6f30393"
        },
        {
          "name": "worker-0.1.756",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/beam-cloud/beta9/releases/tag/worker-0.1.756"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eUpgrade the Beta9 worker to 0.1.756 or later. Sandbox file APIs and workspace sync use os.OpenRoot, so parent-directory segments and symbolic links stay inside the container root or the mount source. File operations refuse read-only mounts and do not write through a symlink swapped in after path resolution. The fix is commit a28bf12 (pull request 1897), released as worker-0.1.756 on 2026-09-15.\u003c/p\u003e"
            }
          ],
          "value": "Upgrade the Beta9 worker to 0.1.756 or later. Sandbox file APIs and workspace sync use os.OpenRoot, so parent-directory segments and symbolic links stay inside the container root or the mount source. File operations refuse read-only mounts and do not write through a symlink swapped in after path resolution. The fix is commit a28bf12 (pull request 1897), released as worker-0.1.756 on 2026-09-15."
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "timeline": [
        {
          "lang": "en",
          "time": "2026-09-15T04:03:00.000Z",
          "value": "Fix merged in pull request 1897 (commit a28bf12)"
        },
        {
          "lang": "en",
          "time": "2026-09-15T04:03:00.000Z",
          "value": "Fixed release worker-0.1.756 published. No vendor security advisory was filed with the pull request."
        }
      ],
      "title": "Beta9 container escape via unvalidated sandbox file paths",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "48a46f29-ae42-4e1d-90dd-c1676c1e5e6d",
    "assignerShortName": "JFROG",
    "cveId": "CVE-2026-120307",
    "datePublished": "2026-11-01T12:49:51.981Z",
    "dateReserved": "2026-11-01T12:45:12.430Z",
    "dateUpdated": "2026-11-01T12:49:51.981Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "collectionURL": "https://github.com/beam-cloud/beta9/releases",
          "defaultStatus": "unaffected",
          "packageName": "github.com/beam-cloud/beta9",
          "product": "Beta9 worker",
          "programFiles": [
            "docker/Dockerfile.worker",
            "pkg/worker/image.go",
            "pkg/worker/image_build_layered.go",
            "pkg/abstractions/image/builder.go",
            "pkg/scheduler/pool_local.go"
          ],
          "repo": "git://github.com/beam-cloud/beta9",
          "vendor": "beam-cloud",
          "versions": [
            {
              "lessThan": "0.1.756",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Natan Nehorai"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "JFrog Security Research"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eBeta9 turns each shell command in a tenant image definition into a Dockerfile RUN line and executes it with Buildah on the build worker. The worker image sets BUILDAH_ISOLATION=chroot, and no buildah invocation passes --isolation, so the step only changes its filesystem root. It keeps the worker pod\u0027s PID, network, IPC, and user namespaces, runs as uid 0, and holds CAP_DAC_OVERRIDE. PID 1 in that procfs is the worker entrypoint, so /proc/1/root is the worker container\u0027s filesystem and is writable. That filesystem contains the runc, buildah, and runsc binaries the worker uses to start tenant containers, the worker\u0027s Kubernetes service account token, and the host directories mounted into the pod. Worker pods are privileged. Clip v2 layered builds are the default, so a tenant with a workspace token reaches this by submitting one image build. The read-only proof confirmed the shared namespaces, CAP_DAC_OVERRIDE, and that the worker\u0027s runc binary is visible at /proc/1/root. Fixed in worker 0.1.756: Buildah RUN steps, including the WORKDIR mkdir, use OCI isolation with private PID, IPC, and network namespaces, and tenant ARG values are passed only into the build container.\u003c/p\u003e"
            }
          ],
          "value": "Beta9 turns each shell command in a tenant image definition into a Dockerfile RUN line and executes it with Buildah on the build worker. The worker image sets BUILDAH_ISOLATION=chroot, and no buildah invocation passes --isolation, so the step only changes its filesystem root. It keeps the worker pod\u0027s PID, network, IPC, and user namespaces, runs as uid 0, and holds CAP_DAC_OVERRIDE. PID 1 in that procfs is the worker entrypoint, so /proc/1/root is the worker container\u0027s filesystem and is writable. That filesystem contains the runc, buildah, and runsc binaries the worker uses to start tenant containers, the worker\u0027s Kubernetes service account token, and the host directories mounted into the pod. Worker pods are privileged. Clip v2 layered builds are the default, so a tenant with a workspace token reaches this by submitting one image build. The read-only proof confirmed the shared namespaces, CAP_DAC_OVERRIDE, and that the worker\u0027s runc binary is visible at /proc/1/root. Fixed in worker 0.1.756: Buildah RUN steps, including the WORKDIR mkdir, use OCI isolation with private PID, IPC, and network namespaces, and tenant ARG values are passed only into the build container."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.9,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "Default clip v2 layered image build on a privileged build-pool worker"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-653",
              "description": "CWE-653: Improper Isolation or Compartmentalization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-269",
              "description": "CWE-269: Improper Privilege Management",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-01T12:49:05.857Z",
        "orgId": "48a46f29-ae42-4e1d-90dd-c1676c1e5e6d",
        "shortName": "JFROG"
      },
      "references": [
        {
          "name": "Beta9 repository",
          "tags": [
            "product"
          ],
          "url": "https://github.com/beam-cloud/beta9"
        },
        {
          "name": "Handle sandbox edge cases (fix pull request)",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/beam-cloud/beta9/pull/1897"
        },
        {
          "name": "Fix commit a28bf12",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/beam-cloud/beta9/commit/a28bf12cf0007c792a25d8ed282b4e8bf6f30393"
        },
        {
          "name": "worker-0.1.756",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/beam-cloud/beta9/releases/tag/worker-0.1.756"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eUpgrade the Beta9 worker to 0.1.756 or later. That release drops chroot isolation: Buildah RUN steps use OCI isolation with private PID, IPC, and network namespaces, and tenant build arguments are applied inside the build container rather than in the Buildah process environment. The fix is commit a28bf12 (pull request 1897), released as worker-0.1.756 on 2026-09-15. Gateway 0.1.776 is the gateway tag cut from the same commit; the isolation change itself is in the worker image.\u003c/p\u003e"
            }
          ],
          "value": "Upgrade the Beta9 worker to 0.1.756 or later. That release drops chroot isolation: Buildah RUN steps use OCI isolation with private PID, IPC, and network namespaces, and tenant build arguments are applied inside the build container rather than in the Buildah process environment. The fix is commit a28bf12 (pull request 1897), released as worker-0.1.756 on 2026-09-15. Gateway 0.1.776 is the gateway tag cut from the same commit; the isolation change itself is in the worker image."
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "timeline": [
        {
          "lang": "en",
          "time": "2026-09-15T04:03:00.000Z",
          "value": "Fix merged in pull request 1897 (commit a28bf12)"
        },
        {
          "lang": "en",
          "time": "2026-09-15T04:03:00.000Z",
          "value": "Fixed release worker-0.1.756 published. No vendor security advisory was filed with the pull request."
        }
      ],
      "title": "Beta9 build sandbox escape via chroot-only isolation",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "48a46f29-ae42-4e1d-90dd-c1676c1e5e6d",
    "assignerShortName": "JFROG",
    "cveId": "CVE-2026-120306",
    "datePublished": "2026-11-01T12:49:05.857Z",
    "dateReserved": "2026-11-01T12:32:40.057Z",
    "dateUpdated": "2026-11-01T12:49:05.857Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}