CVE-2026-120306

Beta9 tenant image builds share privileged worker namespaces

Beam Cloud · Beta9 serverless AI runtime build worker

First documented disclosure · Review checkpoint

Summary

A tenant image build can reach the privileged worker filesystem because its RUN steps use chroot isolation.

Severity and exploitation evidence

Critical · 9.9/10 · CVSS 3.1. Severity source.

Exploitation not established: Researcher read-only proof documented by the CNA; no malicious exploitation or confirmed victim established.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

Buildah inherits chroot isolation rather than private namespaces. Tenant commands run as root with CAP_DAC_OVERRIDE and share the worker PID, network, IPC and user namespaces.

Conditions required

A tenant workspace token and permission to submit an image build to an affected worker; clip v2 layered builds are the default configuration described by the CNA.

Potential impact

Potential access to worker binaries, service-account credentials and host-mounted directories, with consequences dependent on deployment privileges. The cited read-only proof established shared namespaces and visibility of the worker runtime binary, not destructive takeover.

Affected versions and configurations

Beta9 worker before 0.1.756 according to JFrog CNA.

Fix and mitigation status

Worker 0.1.756 fixes this issue; use current supported fixed worker images.

Practical next steps

Update all build workers and verify OCI isolation with private PID, IPC and network namespaces. Keep tenant build arguments out of the worker process environment and minimize worker credentials and privileges.

Operating lesson

Image building is tenant code execution and needs an isolation boundary independent of its filesystem root.

Evidence and limits

The linked public fix PR opened September 14 and merged September 15; worker fix release September 15; detailed CNA publication November 1. The CNA explicitly maps the patch to this CVE. Read-only research does not establish malicious exploitation or compromise of Beam’s hosted service.

Sources