Path traversal in Beta9 lets tenants access worker host files
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA.
Summary
Beta9 gateway and worker are affected before 0.1.776 and before 0.1.756 respectively. The gateway builds a volume host path without checking that the volume identifier belongs to the workspace, so parent-directory segments (CWE-22) let a tenant escape the volumes root. A tenant with a workspace token can read and write the worker's files, including other tenants' volumes, because the worker mounts that path read-write unless the volume is read-only.
Written with Claude Haiku 5.5 from the sources below · 2026-11-02
Description from the CNA
A Beta9 tenant can attach a volume when deploying a function, endpoint, or task queue. The gateway builds the host path by joining the shared volumes root, the workspace name, and the volume identifier from the stub configuration. Nothing checks that the identifier names a volume that workspace owns. Parent-directory segments in the identifier collapse the joined path to the worker's filesystem root, and the worker bind-mounts that path into the sandbox read-write unless the volume was explicitly marked read-only. A tenant with a workspace token can therefore read and write the worker's files, including other tenants' volumes stored on that machine. Confirmed against gateway 0.1.769 and worker 0.1.745. Fixed in gateway 0.1.776 and worker 0.1.756: volume identifiers and mount paths are validated before a mount is built, including for stubs saved before the check existed, and the gateway rejects a volume that does not exist or is not owned by the workspace.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| beam-cloud | Beta9 gateway | before 0.1.776 | 0.1.776 | Patch available | CNA |
| beam-cloud | Beta9 worker | before 0.1.756 | 0.1.756 | Patch available | CNA |
- Beta9 gateway Vendorbeam-cloud Affected before 0.1.776 Fixed in 0.1.776 Patch available CNA
- Beta9 worker Vendorbeam-cloud Affected before 0.1.756 Fixed in 0.1.756 Patch available CNA
Remediation
Upgrade Beta9 gateway to 0.1.776 and Beta9 worker to 0.1.756. The fixes validate volume identifiers and mount paths, including for stubs saved before the check existed, and reject volumes that do not exist or are not owned by the workspace.
Written with Claude Haiku 5.5 from the sources below · 2026-11-02
- Fix · CNA Beta9 gateway (beam-cloud) Fixed in 0.1.776
- Fix · CNA Beta9 worker (beam-cloud) Fixed in 0.1.756
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
beam-cloud Beta9 worker 0.1.756
3 records Highest priority Priority MEDIUM 3 MEDIUM
Other records, highest priority first
- TI-2026-83618 Path traversal in Beta9 worker file API exposes host filesPriority MEDIUM 43
- TI-2026-83617 Sandbox escape in Beta9 build worker via chroot-only isolationPriority MEDIUM 43
Timeline
- 2026-11-01 Threatist record created from CVE-2026-120308
- 2026-11-01 Alias added: GHSA-92w2-g272-fr77
- 2026-11-02 CISA SSVC decision points changed
References
More beam-cloud vulnerabilities
- TI-2026-83618 Path traversal in Beta9 worker file API exposes host files CVSS 3.1CRITICAL 9.9
- TI-2026-83617 Sandbox escape in Beta9 build worker via chroot-only isolation CVSS 3.1CRITICAL 9.9
Sources
- CVE-2026-120308 · CVE Program
- CVE-2026-120308 · NVD
- FIRST EPSS
- GHSA-92w2-g272-fr77 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences