CVE-2026-120308

Beta9 volume identifiers can mount the worker filesystem

Beam Cloud · Beta9 serverless AI runtime gateway and worker

First documented disclosure · Review checkpoint

Summary

A tenant can supply a crafted volume identifier that resolves to the worker filesystem rather than an owned volume.

Severity and exploitation evidence

Critical · 9.9/10 · CVSS 3.1. Severity source.

Exploitation not established: Controlled research or code-path evidence; the reviewed sources do not establish malicious exploitation or a confirmed victim.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

The gateway joins the shared volume root, workspace and unvalidated volume ID. Parent segments can collapse the path to the worker root, which is then mounted read-write by default.

Conditions required

A tenant workspace token and a deployment attaching a volume to a function, endpoint or task queue on affected gateway/worker versions.

Potential impact

Read and write access to worker files and other tenants’ volumes present on that worker; scope is the resources exposed by the worker and deployment privileges.

Affected versions and configurations

CNA: gateway before 0.1.776 and worker before 0.1.756; confirmed against gateway 0.1.769 and worker 0.1.745.

Fix and mitigation status

Gateway 0.1.776 and worker 0.1.756 add identifier/path validation and workspace ownership checks, including validation of persisted stubs.

Practical next steps

Update both gateway and workers, check that volume IDs belong to the requesting workspace, reject traversal in IDs and mount paths, and validate previously saved deployment configurations before launch.

Operating lesson

A volume identifier is an authorization decision, not merely a filesystem path.

Evidence and limits

The public patch PR opened September 14; fixed gateway and worker releases are September 15; CVE published November 1. The CNA separately maps this volume issue, image-build issue and file-API issue to three identities; they are not three victim incidents.

Sources