Zero Radar
← feed
CriticalVulnerabilityCVE-2026-120306updated 1 Nov 2026, 13:21 UTC

Beta9 image builds let tenants reach build worker internals

A customer who submits a container image build can break out of the build's sandbox and reach files on the build machine. Those files include the machine's access token, which could be used against the rest of the system.

Fixed in Beta9 worker 0.1.756 · out Official source
SeverityCriticalCVSS 9.9 of 10
Being exploited?UnclearNo reports either way yet
Fix available?YesBeta9 worker 0.1.756 · since 1 Nov 2026,
How sure is this?Official sourceBacked by an official source

How the attack works simplified

  1. 1Tenant submits image buildOne build request needs a workspace token
  2. 2Shell command becomes RUN stepBuildah runs it with chroot isolation only
  3. 3Build reaches worker filesystem/proc/1/root is the worker container's filesystem
  4. 4Worker credentials exposedService account token and runc binary are reachable
  5. ResultTenant reads worker's service account token

What happened

Beta9 runs tenant image build commands via Buildah on the worker with only chroot isolation, while keeping shared PID, network, IPC, and user namespaces, running as root with CAP_DAC_OVERRIDE. Through /proc/1/root, a tenant can write to the worker container's filesystem.

Why it is dangerous: A tenant with a workspace token can reach the worker's runc binary, its Kubernetes service account token, and host directories mounted into the pod. This affects other tenants and the platform that share these workers.

Are you affected?

You are affected if you run Beta9 build workers older than 0.1.756 and allow tenants to submit image builds.

Beta9 worker versions before 0.1.756

What to do

  1. Update Beta9 workers to version 0.1.756 or later.
  2. Confirm every worker in every cluster is running 0.1.756 or later after the update.

Timeline

  1. 1 Nov 2026, 13:18 UTC
    Publicly disclosed
  2. 1 Nov 2026, 13:18 UTC
    Reported by NVD · NVD
  3. 1 Nov 2026, 13:21 UTC
    Picked up by Zero Radar

Sources 1 report, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-120306
CVSS
9.9 / 10
Disclosed
1 Nov 2026, 13:18 UTC
On Zero Radar
1 Nov 2026, 13:21 UTC (3 min after disclosure)
Last change
1 Nov 2026, 13:21 UTC

The plain-language parts and the attack diagram were written by an AI model (claude-haiku-5-5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Beta9 image builds let tenants reach build worker internals · Zero Radar