Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-120306— Beta9 build sandbox escape via chroot-only isolation

Quick assessment

Affected
beam-cloud Beta9 worker
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Beta9 会将租户镜像定义中的每条 Shell 命令转换为 Dockerfile 的 RUN 指令，并在构建工作节点上通过 Buildah 执行。工作节点镜像设置了 ，且所有 Buildah 调用均未传递 参数，因此该步骤仅更改文件系统根目录。它保留了工作节点 Pod 的 PID、网络、IPC 和用户命名空间，以 uid 0 运行，并持有 能力。在该 procfs 中，PID 1 是工作节点的入口点，因此 指向工作节点容器的文件系统且可写。该文件系统包含了工作节点用于启动租户容器的 、 和 二进制文件、工作节点的

CVSS 9.9 · Critical

Affected Version Matrix 1

VendorProduct Version RangeStatus
beam-cloud Beta9 worker < 0.1.756 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-120306

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Beta9 build sandbox escape via chroot-only isolation
Source: CVE Program / CVE List V5
Vulnerability Description
Beta9 turns each shell command in a tenant image definition into a Dockerfile RUN line and executes it with Buildah on the build worker. The worker image sets BUILDAH_ISOLATION=chroot, and no buildah invocation passes --isolation, so the step only changes its filesystem root. It keeps the worker pod's PID, network, IPC, and user namespaces, runs as uid 0, and holds CAP_DAC_OVERRIDE. PID 1 in that procfs is the worker entrypoint, so /proc/1/root is the worker container's filesystem and is writable. That filesystem contains the runc, buildah, and runsc binaries the worker uses to start tenant containers, the worker's Kubernetes service account token, and the host directories mounted into the pod. Worker pods are privileged. Clip v2 layered builds are the default, so a tenant with a workspace token reaches this by submitting one image build. The read-only proof confirmed the shared namespaces, CAP_DAC_OVERRIDE, and that the worker's runc binary is visible at /proc/1/root. Fixed in worker 0.1.756: Buildah RUN steps, including the WORKDIR mkdir, use OCI isolation with private PID, IPC, and network namespaces, and tenant ARG values are passed only into the build container.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
不充分的划分
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
beam-cloud Beta9 worker 0 ~ 0.1.756 -

II. Public POCs for CVE-2026-120306

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-120306

请登录查看更多情报信息。

Other References for CVE-2026-120306 (4)

Same Patch Batch · beam-cloud · 2026-11-01 · 3 CVEs total

CVE-2026-120308 9.9 CRITICAL Beta9 host filesystem exposure via volume path traversal
CVE-2026-120307 9.9 CRITICAL Beta9 container escape via unvalidated sandbox file paths

IV. Related Vulnerabilities

Same product: Beta9 worker
Same vendor: beam-cloud
Same weakness: CWE-653