---
id: CVE-2026-120307
title: Beta9 container escape via unvalidated sandbox file paths
summary: >-
  The Beta9 worker serves the sandbox file API from outside the container.
  getHostPathFromContainerPath turns the tenant's container path into a worker
  path. If the unresolved path starts with a mount destination, including the
  default upl…
severity: critical
cvss: 9.9
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-22
  - CWE-23
  - CWE-59
vendor: beam-cloud
product: github.com/beam-cloud/beta9
affected:
  - github.com/beam-cloud/beta9 < 0.1.756
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-11-02T19:46:03.614684Z'
published: '2026-11-01'
updated: '2026-11-02'
sourceUpdated: '2026-11-02T19:46:38.442Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-120307'
references:
  - url: 'https://github.com/beam-cloud/beta9'
    label: Beta9 repository
  - url: 'https://github.com/beam-cloud/beta9/pull/1897'
    label: Handle sandbox edge cases (fix pull request)
  - url: >-
      https://github.com/beam-cloud/beta9/commit/a28bf12cf0007c792a25d8ed282b4e8bf6f30393
    label: Fix commit a28bf12
  - url: 'https://github.com/beam-cloud/beta9/releases/tag/worker-0.1.756'
    label: worker-0.1.756
tags:
  - cve.org
epss: 0.00484
epssPercentile: 0.41811
ingestedAt: '2026-11-05T19:30:42.811Z'
---

## Overview

The Beta9 worker serves the sandbox file API from outside the container. getHostPathFromContainerPath turns the tenant's container path into a worker path. If the unresolved path starts with a mount destination, including the default upload mount at /tmp/.beta9, the remainder is joined onto that mount's source with filepath.Join, which cleans parent-directory segments after the prefix check. A long enough run of those segments names any absolute path on the worker. A path that matches no mount is joined onto the container root and opened in the worker's own filesystem, so an absolute symbolic link such as /var/run pointing at /run is followed against the worker root. Upload, download, stat, list, find-in-files, replace-in-files, and delete-file all call this helper. A tenant with a workspace token and one running sandbox can read, write, list, and delete files on the hosting worker as root, including files of other tenants on that machine. A read-only proof downloaded the worker pod's Kubernetes service account token through the file API for a path that did not exist inside the sandbox. In the shipped remote-node manifests that service account is bound to cluster-admin. Fixed in worker 0.1.756: sandbox file operations and workspace sync open paths with os.OpenRoot, so parent-directory and symlink lookups stay inside the container root or the mount source.

## Affected

- `github.com/beam-cloud/beta9 < 0.1.756`

## Remediation

Upgrade the Beta9 worker to 0.1.756 or later. Sandbox file APIs and workspace sync use os.OpenRoot, so parent-directory segments and symbolic links stay inside the container root or the mount source. File operations refuse read-only mounts and do not write through a symlink swapped in after path resolution. The fix is commit a28bf12 (pull request 1897), released as worker-0.1.756 on 2026-09-15.