CVE-2026-120307

Beta9 sandbox file API can escape into worker files

Beam Cloud · Beta9 serverless AI runtime sandbox file API

First documented disclosure · Review checkpoint

Summary

A tenant file request can resolve outside its sandbox and access files on the hosting worker.

Severity and exploitation evidence

Critical · 9.9/10 · CVSS 3.1. Severity source.

Exploitation not established: Controlled read-only proof recovered a worker service-account token according to the CNA; malicious exploitation is not established.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

Host-side path translation checks mount prefixes before cleaning parent segments, while unmatched paths can follow absolute symlinks against the worker root. Multiple file operations share the helper.

Conditions required

A valid tenant workspace token and a running sandbox on an affected worker serving the file API.

Potential impact

Root-level read, write, listing and deletion of worker files and other tenants’ local data. The CNA describes a read-only proof downloading the worker service-account token; cluster-admin impact applies to the shipped remote-node manifests, not every installation.

Affected versions and configurations

Beta9 worker before 0.1.756 according to JFrog CNA.

Fix and mitigation status

Worker 0.1.756 confines sandbox file operations and workspace sync using os.OpenRoot.

Practical next steps

Update affected workers, verify scoped-root file operations, and limit service-account privileges. Investigate file-API access and rotate exposed worker credentials if evidence shows they were read.

Operating lesson

A sandbox file API must resolve paths inside the sandbox boundary even when it runs outside the container.

Evidence and limits

Public fix PR September 14, fix release September 15 and CNA November 1 are distinct dates. The CNA explicitly identifies this patch. The reported token-read demonstration is controlled research, not evidence of a production victim.

Sources