FKIE_CVE-2026-120308

Vulnerability from fkie_nvd - Published: 2026-11-01 13:18 - Updated: 2026-11-01 13:18
Severity
9.9 (Critical) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Summary
A Beta9 tenant can attach a volume when deploying a function, endpoint, or task queue. The gateway builds the host path by joining the shared volumes root, the workspace name, and the volume identifier from the stub configuration. Nothing checks that the identifier names a volume that workspace owns. Parent-directory segments in the identifier collapse the joined path to the worker's filesystem root, and the worker bind-mounts that path into the sandbox read-write unless the volume was explicitly marked read-only. A tenant with a workspace token can therefore read and write the worker's files, including other tenants' volumes stored on that machine. Confirmed against gateway 0.1.769 and worker 0.1.745. Fixed in gateway 0.1.776 and worker 0.1.756: volume identifiers and mount paths are validated before a mount is built, including for stubs saved before the check existed, and the gateway rejects a volume that does not exist or is not owned by the workspace.
References
reefs@jfrog.comhttps://github.com/beam-cloud/beta9
reefs@jfrog.comhttps://github.com/beam-cloud/beta9/commit/a28bf12cf0007c792a25d8ed282b4e8bf6f30393
reefs@jfrog.comhttps://github.com/beam-cloud/beta9/pull/1897
reefs@jfrog.comhttps://github.com/beam-cloud/beta9/releases/tag/gateway-0.1.769
reefs@jfrog.comhttps://github.com/beam-cloud/beta9/releases/tag/gateway-0.1.776
reefs@jfrog.comhttps://github.com/beam-cloud/beta9/releases/tag/worker-0.1.745
reefs@jfrog.comhttps://github.com/beam-cloud/beta9/releases/tag/worker-0.1.756
Impacted products
Vendor Product Version
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "collectionURL": "https://github.com/beam-cloud/beta9/releases",
          "defaultStatus": "unaffected",
          "packageName": "github.com/beam-cloud/beta9",
          "product": "Beta9 gateway",
          "programFiles": [
            "pkg/abstractions/common/mount.go",
            "pkg/gateway/services/stub.go"
          ],
          "repo": "git://github.com/beam-cloud/beta9",
          "vendor": "beam-cloud",
          "versions": [
            {
              "lessThan": "0.1.776",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://github.com/beam-cloud/beta9/releases",
          "defaultStatus": "unaffected",
          "packageName": "github.com/beam-cloud/beta9",
          "product": "Beta9 worker",
          "programFiles": [
            "pkg/abstractions/common/mount.go",
            "pkg/worker/lifecycle.go"
          ],
          "repo": "git://github.com/beam-cloud/beta9",
          "vendor": "beam-cloud",
          "versions": [
            {
              "lessThan": "0.1.756",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "source": "reefs@jfrog.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A Beta9 tenant can attach a volume when deploying a function, endpoint, or task queue. The gateway builds the host path by joining the shared volumes root, the workspace name, and the volume identifier from the stub configuration. Nothing checks that the identifier names a volume that workspace owns. Parent-directory segments in the identifier collapse the joined path to the worker\u0027s filesystem root, and the worker bind-mounts that path into the sandbox read-write unless the volume was explicitly marked read-only. A tenant with a workspace token can therefore read and write the worker\u0027s files, including other tenants\u0027 volumes stored on that machine. Confirmed against gateway 0.1.769 and worker 0.1.745. Fixed in gateway 0.1.776 and worker 0.1.756: volume identifiers and mount paths are validated before a mount is built, including for stubs saved before the check existed, and the gateway rejects a volume that does not exist or is not owned by the workspace."
    }
  ],
  "id": "CVE-2026-120308",
  "lastModified": "2026-11-01T13:18:01.670",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 9.9,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "CHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.1,
        "impactScore": 6.0,
        "source": "reefs@jfrog.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-11-01T13:18:01.670",
  "references": [
    {
      "source": "reefs@jfrog.com",
      "url": "https://github.com/beam-cloud/beta9"
    },
    {
      "source": "reefs@jfrog.com",
      "url": "https://github.com/beam-cloud/beta9/commit/a28bf12cf0007c792a25d8ed282b4e8bf6f30393"
    },
    {
      "source": "reefs@jfrog.com",
      "url": "https://github.com/beam-cloud/beta9/pull/1897"
    },
    {
      "source": "reefs@jfrog.com",
      "url": "https://github.com/beam-cloud/beta9/releases/tag/gateway-0.1.769"
    },
    {
      "source": "reefs@jfrog.com",
      "url": "https://github.com/beam-cloud/beta9/releases/tag/gateway-0.1.776"
    },
    {
      "source": "reefs@jfrog.com",
      "url": "https://github.com/beam-cloud/beta9/releases/tag/worker-0.1.745"
    },
    {
      "source": "reefs@jfrog.com",
      "url": "https://github.com/beam-cloud/beta9/releases/tag/worker-0.1.756"
    }
  ],
  "sourceIdentifier": "reefs@jfrog.com",
  "vulnStatus": "Received",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        },
        {
          "lang": "en",
          "value": "CWE-668"
        }
      ],
      "source": "reefs@jfrog.com",
      "type": "Primary"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.