CVE-2026-120308

    Dashboard / Vulnerabilities / CVE-2026-120308

    CVE-2026-120308

    Published: 1 Nov 2026Last Modified: 2 Nov 2026

    Summary: Beta9 host filesystem exposure via volume path traversal

    Details: A Beta9 tenant can attach a volume when deploying a function, endpoint, or task queue. The gateway builds the host path by joining the shared volumes root, the workspace name, and the volume identifier from the stub configuration. Nothing checks that the identifier names a volume that workspace owns. Parent-directory segments in the identifier collapse the joined path to the worker's filesystem root, and the worker bind-mounts that path into the sandbox read-write unless the volume was explicitly marked read-only. A tenant with a workspace token can therefore read and write the worker's files, including other tenants' volumes stored on that machine. Confirmed against gateway 0.1.769 and worker 0.1.745. Fixed in gateway 0.1.776 and worker 0.1.756: volume identifiers and mount paths are validated before a mount is built, including for stubs saved before the check existed, and the gateway rejects a volume that does not exist or is not owned by the workspace.

    References: git://github.com/beam-cloud/beta9, https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/120xxx/CVE-2026-120308.json, https://github.com/beam-cloud/beta9, https://github.com/beam-cloud/beta9/commit/a28bf12cf0007c792a25d8ed282b4e8bf6f30393, https://github.com/beam-cloud/beta9/pull/1897, https://github.com/beam-cloud/beta9/releases, https://github.com/beam-cloud/beta9/releases/tag/gateway-0.1.769, https://github.com/beam-cloud/beta9/releases/tag/gateway-0.1.776, https://github.com/beam-cloud/beta9/releases/tag/worker-0.1.745, https://github.com/beam-cloud/beta9/releases/tag/worker-0.1.756, https://nvd.nist.gov/vuln/detail/CVE-2026-120308

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -1856234776a0c19a3f163d33af7de8d6cc611e77

    Affected versions

    worker-0.1.755
    worker-0.1.754
    worker-0.1.753
    worker-0.1.752
    worker-0.1.751
    worker-0.1.750
    worker-0.1.749
    worker-0.1.748
    worker-0.1.747
    worker-0.1.746
    worker-0.1.745
    worker-0.1.744
    worker-0.1.743
    worker-0.1.742
    worker-0.1.741
    worker-0.1.740
    worker-0.1.739
    worker-0.1.738
    worker-0.1.737
    worker-0.1.736
    worker-0.1.735
    worker-0.1.734
    worker-0.1.733
    worker-0.1.732
    worker-0.1.731
    worker-0.1.730
    worker-0.1.729
    worker-0.1.728
    worker-0.1.727
    worker-0.1.726
    worker-0.1.725
    worker-0.1.724
    worker-0.1.723
    worker-0.1.722
    worker-0.1.721
    worker-0.1.720
    worker-0.1.719
    worker-0.1.718
    worker-0.1.717
    worker-0.1.716
    worker-0.1.715
    worker-0.1.712
    worker-0.1.711
    worker-0.1.710
    worker-0.1.709
    worker-0.1.708
    worker-0.1.707
    worker-0.1.706
    worker-0.1.705
    worker-0.1.704
    worker-0.1.703
    worker-0.1.702
    worker-0.1.701
    worker-0.1.700
    worker-0.1.699
    worker-0.1.698
    worker-0.1.697
    worker-0.1.696
    worker-0.1.695
    worker-0.1.694
    worker-0.1.693
    worker-0.1.692
    worker-0.1.691
    worker-0.1.690
    worker-0.1.689
    worker-0.1.688
    worker-0.1.687
    worker-0.1.686
    worker-0.1.685
    worker-0.1.684
    worker-0.1.683
    worker-0.1.682
    worker-0.1.680
    worker-0.1.679
    worker-0.1.678
    worker-0.1.677
    worker-0.1.676
    worker-0.1.675
    worker-0.1.674
    worker-0.1.673
    worker-0.1.672
    worker-0.1.671
    worker-0.1.670
    worker-0.1.669
    worker-0.1.668
    worker-0.1.667
    worker-0.1.666
    worker-0.1.665
    worker-0.1.664
    worker-0.1.663
    worker-0.1.662
    worker-0.1.661
    worker-0.1.660
    worker-0.1.659
    worker-0.1.658
    worker-0.1.657
    worker-0.1.656
    worker-0.1.655
    worker-0.1.654
    worker-0.1.653
    worker-0.1.652
    worker-0.1.651
    worker-0.1.650
    worker-0.1.649
    worker-0.1.648
    worker-0.1.647
    worker-0.1.646
    worker-0.1.645
    worker-0.1.644
    worker-0.1.643
    worker-0.1.642
    worker-0.1.641
    worker-0.1.640
    worker-0.1.639
    worker-0.1.638
    worker-0.1.637
    worker-0.1.636
    worker-0.1.635
    worker-0.1.634
    worker-0.1.633
    worker-0.1.632
    worker-0.1.631
    worker-0.1.630
    worker-0.1.629
    worker-0.1.628
    worker-0.1.627
    worker-0.1.626
    worker-0.1.625
    worker-0.1.624
    worker-0.1.623
    worker-0.1.622
    worker-0.1.621
    worker-0.1.620
    worker-0.1.619
    worker-0.1.618
    worker-0.1.617
    worker-0.1.616
    worker-0.1.615
    worker-0.1.614
    worker-0.1.613
    worker-0.1.612
    worker-0.1.611
    worker-0.1.610
    worker-0.1.609
    worker-0.1.608
    worker-0.1.607
    worker-0.1.606
    worker-0.1.605
    worker-0.1.604
    worker-0.1.603
    worker-0.1.602
    worker-0.1.601
    worker-0.1.600
    worker-0.1.599
    worker-0.1.598
    worker-0.1.597
    worker-0.1.596
    worker-0.1.595
    worker-0.1.594
    worker-0.1.593
    worker-0.1.592
    worker-0.1.591
    worker-0.1.590
    worker-0.1.589
    worker-0.1.588
    worker-0.1.587
    worker-0.1.586
    worker-0.1.585
    worker-0.1.584
    worker-0.1.583
    worker-0.1.582
    worker-0.1.577
    worker-0.1.576
    worker-0.1.575
    worker-0.1.574
    worker-0.1.573
    worker-0.1.572
    worker-0.1.571
    worker-0.1.570
    worker-0.1.569
    worker-0.1.568
    worker-0.1.567
    worker-0.1.566
    worker-0.1.565
    worker-0.1.564
    worker-0.1.563
    worker-0.1.562
    worker-0.1.561
    worker-0.1.560
    worker-0.1.559
    worker-0.1.558
    worker-0.1.557
    worker-0.1.556
    worker-0.1.555
    worker-0.1.554
    worker-0.1.553
    worker-0.1.546
    worker-0.1.552
    worker-0.1.551
    worker-0.1.550
    worker-0.1.549
    worker-0.1.548
    worker-0.1.547
    worker-0.1.545
    worker-0.1.544
    worker-0.1.543
    worker-0.1.542
    worker-0.1.541
    worker-0.1.540
    worker-0.1.539
    worker-0.1.538
    worker-0.1.537
    worker-0.1.536
    worker-0.1.535
    worker-0.1.534
    worker-0.1.533
    worker-0.1.532
    worker-0.1.531
    worker-0.1.530
    worker-0.1.529
    worker-0.1.528
    worker-0.1.527
    worker-0.1.526
    worker-0.1.525
    worker-0.1.524
    worker-0.1.523
    worker-0.1.522
    worker-0.1.521
    worker-0.1.520
    worker-0.1.519
    worker-0.1.518
    worker-0.1.517
    worker-0.1.516
    worker-0.1.515
    worker-0.1.514
    worker-0.1.513
    worker-0.1.512
    worker-0.1.511
    worker-0.1.510
    worker-0.1.509
    worker-0.1.508
    worker-0.1.507
    worker-0.1.506
    worker-0.1.505
    worker-0.1.504
    worker-0.1.503
    worker-0.1.502
    worker-0.1.501
    worker-0.1.500
    worker-0.1.499
    worker-0.1.498
    worker-0.1.497
    worker-0.1.496
    worker-0.1.495
    worker-0.1.494
    worker-0.1.493
    worker-0.1.492
    worker-0.1.491
    worker-0.1.490
    worker-0.1.489
    worker-0.1.488
    worker-0.1.487
    worker-0.1.486
    worker-0.1.485
    worker-0.1.484
    worker-0.1.483
    worker-0.1.482
    worker-0.1.481
    worker-0.1.480
    worker-0.1.479
    worker-0.1.478
    worker-0.1.477
    worker-0.1.476
    worker-0.1.475
    worker-0.1.474
    worker-0.1.473
    worker-0.1.472
    worker-0.1.471
    worker-0.1.470
    worker-0.1.469
    worker-0.1.468
    worker-0.1.467
    worker-0.1.466
    worker-0.1.465
    worker-0.1.464
    worker-0.1.463
    worker-0.1.462
    worker-0.1.461
    worker-0.1.460
    worker-0.1.459
    worker-0.1.458
    worker-0.1.457
    worker-0.1.456
    worker-0.1.455
    worker-0.1.454
    worker-0.1.453
    worker-0.1.452
    worker-0.1.451
    worker-0.1.450
    worker-0.1.449
    worker-0.1.448
    worker-0.1.447
    worker-0.1.446
    worker-0.1.445
    worker-0.1.444
    worker-0.1.443
    worker-0.1.442
    worker-0.1.441
    worker-0.1.440
    worker-0.1.439
    worker-0.1.438
    worker-0.1.437
    worker-0.1.436
    worker-0.1.435
    worker-0.1.434
    worker-0.1.433
    worker-0.1.432
    worker-0.1.431
    worker-0.1.430
    worker-0.1.429
    worker-0.1.428
    worker-0.1.427
    worker-0.1.426
    worker-0.1.425
    worker-0.1.424
    worker-0.1.423
    worker-0.1.422
    worker-0.1.421
    worker-0.1.420
    worker-0.1.419
    worker-0.1.418
    worker-0.1.417
    worker-0.1.416
    worker-0.1.415
    worker-0.1.414
    worker-0.1.413
    worker-0.1.412
    worker-0.1.411
    worker-0.1.410
    worker-0.1.409
    worker-0.1.408
    worker-0.1.407
    worker-0.1.406
    worker-0.1.405
    worker-0.1.404
    worker-0.1.403
    worker-0.1.402
    worker-0.1.401
    worker-0.1.400
    worker-0.1.399
    worker-0.1.398
    worker-0.1.397
    worker-0.1.396
    worker-0.1.395
    worker-0.1.394
    worker-0.1.393
    worker-0.1.392
    worker-0.1.391
    worker-0.1.390
    worker-0.1.389
    worker-0.1.388
    worker-0.1.387
    worker-0.1.386
    worker-0.1.385
    worker-0.1.384
    worker-0.1.383
    worker-0.1.382
    worker-0.1.381
    worker-0.1.380
    worker-0.1.379
    worker-0.1.378
    worker-0.1.377
    worker-0.1.376
    worker-0.1.375
    worker-0.1.374
    worker-0.1.373
    worker-0.1.372
    worker-0.1.371
    worker-0.1.370
    worker-0.1.369
    worker-0.1.368
    worker-0.1.367
    worker-0.1.366
    worker-0.1.365
    worker-0.1.364
    worker-0.1.363
    worker-0.1.362
    worker-0.1.361
    worker-0.1.360
    worker-0.1.359
    worker-0.1.358
    worker-0.1.357
    worker-0.1.356
    worker-0.1.355
    worker-0.1.354
    worker-0.1.353
    worker-0.1.352
    worker-0.1.351
    worker-0.1.350
    worker-0.1.349
    worker-0.1.348
    worker-0.1.347
    worker-0.1.346
    worker-0.1.345
    worker-0.1.344
    worker-0.1.343
    worker-0.1.342
    worker-0.1.341
    worker-0.1.340
    worker-0.1.339
    worker-0.1.338
    worker-0.1.337
    worker-0.1.336
    worker-0.1.335
    worker-0.1.334
    worker-0.1.333
    worker-0.1.332
    worker-0.1.331
    worker-0.1.330
    worker-0.1.329
    worker-0.1.328
    worker-0.1.327
    worker-0.1.326
    worker-0.1.325
    worker-0.1.324
    worker-0.1.323
    worker-0.1.322
    worker-0.1.321
    worker-0.1.320
    worker-0.1.319
    worker-0.1.318
    worker-0.1.317
    worker-0.1.316
    worker-0.1.315
    worker-0.1.314
    worker-0.1.312
    worker-0.1.311
    worker-0.1.310
    worker-0.1.309
    worker-0.1.308
    worker-0.1.307
    worker-0.1.306
    worker-0.1.305
    worker-0.1.304
    worker-0.1.303
    worker-0.1.302
    worker-0.1.301
    worker-0.1.300
    worker-0.1.299
    worker-0.1.298
    worker-0.1.297
    worker-0.1.295
    worker-0.1.294
    worker-0.1.293
    worker-0.1.292
    worker-0.1.291
    worker-0.1.290
    worker-0.1.289
    worker-0.1.288
    worker-0.1.287
    worker-0.1.286
    worker-0.1.285
    worker-0.1.284
    worker-0.1.283
    worker-0.1.282
    worker-0.1.281
    worker-0.1.280
    worker-0.1.279
    worker-0.1.278
    worker-0.1.277
    worker-0.1.276
    worker-0.1.275
    worker-0.1.274
    worker-0.1.273
    worker-0.1.272
    worker-0.1.271
    worker-0.1.270
    worker-0.1.269
    worker-0.1.268
    worker-0.1.267
    worker-0.1.266
    worker-0.1.265
    worker-0.1.264
    worker-0.1.263
    worker-0.1.262
    worker-0.1.261
    worker-0.1.260
    worker-0.1.259
    worker-0.1.258
    worker-0.1.257
    worker-0.1.256
    worker-0.1.255
    worker-0.1.254
    worker-0.1.253
    worker-0.1.252
    worker-0.1.251
    worker-0.1.250
    worker-0.1.249
    worker-0.1.248
    worker-0.1.247
    worker-0.1.246
    worker-0.1.245
    worker-0.1.244
    worker-0.1.243
    worker-0.1.242
    worker-0.1.241
    worker-0.1.240
    worker-0.1.239
    worker-0.1.238
    worker-0.1.237
    worker-0.1.236
    worker-0.1.235
    worker-0.1.234
    worker-0.1.233
    worker-0.1.232
    worker-0.1.231
    worker-0.1.230
    worker-0.1.229
    worker-0.1.228
    worker-0.1.227
    worker-0.1.226
    worker-0.1.225
    worker-0.1.224
    worker-0.1.223
    worker-0.1.222
    worker-0.1.221
    worker-0.1.220
    worker-0.1.219
    worker-0.1.218
    worker-0.1.217
    worker-0.1.216
    worker-0.1.215
    worker-0.1.214
    worker-0.1.213
    worker-0.1.212
    worker-0.1.211
    worker-0.1.210
    worker-0.1.209
    worker-0.1.208
    worker-0.1.207
    worker-0.1.206
    worker-0.1.205
    worker-0.1.204
    worker-0.1.203
    worker-0.1.202
    worker-0.1.201
    worker-0.1.200
    worker-0.1.199
    worker-0.1.198
    worker-0.1.197
    worker-0.1.196
    worker-0.1.195
    worker-0.1.194
    worker-0.1.193
    worker-0.1.192
    worker-0.1.191
    worker-0.1.190
    worker-0.1.189
    worker-0.1.188
    worker-0.1.187
    worker-0.1.186
    worker-0.1.185
    worker-0.1.184
    worker-0.1.183
    worker-0.1.182
    worker-0.1.181
    worker-0.1.180
    worker-0.1.179
    worker-0.1.178
    worker-0.1.177
    worker-0.1.176
    worker-0.1.175
    worker-0.1.174
    worker-0.1.173
    worker-0.1.172
    worker-0.1.171
    worker-0.1.170
    worker-0.1.169
    worker-0.1.168
    worker-0.1.167
    worker-0.1.166
    worker-0.1.165
    worker-0.1.164
    worker-0.1.163
    worker-0.1.162
    worker-0.1.161
    worker-0.1.160
    worker-0.1.159
    worker-0.1.158
    worker-0.1.157
    worker-0.1.156
    worker-0.1.155
    worker-0.1.154
    worker-0.1.153
    worker-0.1.152
    worker-0.1.151
    worker-0.1.150
    worker-0.1.149
    worker-0.1.148
    worker-0.1.147
    worker-0.1.146
    worker-0.1.145
    worker-0.1.144
    worker-0.1.143
    worker-0.1.142
    worker-0.1.141
    worker-0.1.140
    worker-0.1.139
    worker-0.1.138
    worker-0.1.137
    worker-0.1.136
    worker-0.1.135
    worker-0.1.134
    worker-0.1.133
    worker-0.1.132
    worker-0.1.131
    worker-0.1.130
    worker-0.1.129
    worker-0.1.128
    worker-0.1.127
    worker-0.1.126
    worker-0.1.125
    worker-0.1.124
    worker-0.1.123
    worker-0.1.122
    worker-0.1.121
    worker-0.1.120
    worker-0.1.119
    worker-0.1.118
    worker-0.1.117
    worker-0.1.116
    worker-0.1.115
    worker-0.1.114
    worker-0.1.113
    worker-0.1.112
    worker-0.1.111
    worker-0.1.110
    worker-0.1.109
    worker-0.1.108
    worker-0.1.107
    worker-0.1.106
    worker-0.1.105
    worker-0.1.104
    worker-0.1.103
    worker-0.1.102
    worker-0.1.101
    worker-0.1.100
    worker-0.1.99
    worker-0.1.98
    worker-0.1.97
    worker-0.1.96
    worker-0.1.95
    worker-0.1.94
    worker-0.1.93
    worker-0.1.92
    worker-0.1.91
    worker-0.1.90
    worker-0.1.89
    worker-0.1.88
    worker-0.1.87
    worker-0.1.86
    worker-0.1.85
    worker-0.1.82
    worker-0.1.81
    worker-0.1.80
    worker-0.1.79
    worker-0.1.78
    worker-0.1.77
    worker-0.1.76
    worker-0.1.75
    worker-0.1.74
    worker-0.1.73
    worker-0.1.72
    worker-0.1.71
    worker-0.1.70
    worker-0.1.69
    worker-0.1.68
    worker-0.1.67
    worker-0.1.66
    worker-0.1.65
    worker-0.1.64
    worker-0.1.63
    worker-0.1.62
    worker-0.1.61
    worker-0.1.60
    worker-0.1.59
    worker-0.1.58
    worker-0.1.57
    worker-0.1.56
    worker-0.1.55
    worker-0.1.54
    worker-0.1.53
    worker-0.1.52
    worker-0.1.51
    worker-0.1.50
    worker-0.1.49
    worker-0.1.48
    worker-0.1.45
    worker-0.1.44
    worker-0.1.43
    worker-0.1.42
    worker-0.1.41
    worker-0.1.40
    worker-0.1.39
    worker-0.1.38
    worker-0.1.37
    worker-0.1.36
    worker-0.1.35
    worker-0.1.34
    worker-0.1.33
    worker-0.1.32
    worker-0.1.31
    worker-0.1.30
    worker-0.1.29
    worker-0.1.28
    worker-0.1.27
    worker-0.1.26
    worker-0.1.25
    worker-0.1.24
    worker-0.1.23
    worker-0.1.22
    worker-0.1.21
    worker-0.1.20
    worker-0.1.19
    worker-0.1.18
    worker-0.1.17
    worker-0.1.16
    worker-0.1.15
    worker-0.1.14
    worker-0.1.13
    worker-0.1.12
    worker-0.1.11
    worker-0.1.10
    worker-0.1.9
    worker-0.1.8
    worker-0.1.7
    worker-0.1.6
    worker-0.1.5
    worker-0.1.4
    worker-0.1.3
    worker-0.1.2
    worker-0.1.1
    worker-0.1.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High