Zero Radar
← feed
CriticalVulnerabilityCVE-2026-120307updated 1 Nov 2026, 13:21 UTC

Beta9 worker file API lets tenants reach worker host files

A tenant with a sandbox can use the file feature to read, change, or delete files on the shared server running their sandbox, including other customers' files. Attackers may be able to take over the whole cluster.

Fixed in Beta9 worker 0.1.756 · out Official source
SeverityCriticalCVSS 9.9 of 10
Being exploited?UnclearNo reports either way yet
Fix available?YesBeta9 worker 0.1.756 · since 1 Nov 2026,
How sure is this?Official sourceBacked by an official source

How the attack works simplified

  1. 1Tenant holds sandboxHas workspace token and one running sandbox
  2. 2Sends crafted file pathLong run of parent-directory segments after mount prefix
  3. 3Worker joins path unsafelyfilepath.Join cleans segments after prefix check
  4. 4Host file accessed as rootReads, writes, or deletes worker host files
  5. 5Service account token readToken bound to cluster-admin in shipped manifests
  6. ResultAttacker may gain cluster-admin control

What happened

The Beta9 worker's sandbox file API resolves container paths unsafely: long runs of parent-directory segments after a mount prefix escape the mount, and paths that match no mount are joined onto the worker root, so absolute symlinks are followed on the host filesystem.

Why it is dangerous: A tenant with a workspace token and one running sandbox can read, write, list, and delete files as root on the worker, including other tenants' files. The proof-of-concept downloaded the worker pod's Kubernetes service account token, which the shipped remote-node manifests bind to cluster-admin.

Are you affected?

You are affected if you run Beta9 worker versions before 0.1.756 and allow tenants to run sandboxes on your workers.

Beta9 worker, versions before 0.1.756 (the affected range is inferred from the fixed version; exact earlier versions are not stated).

What to do

  1. Update the Beta9 worker to version 0.1.756 or later
  2. Review the remote-node manifests and remove or reduce the cluster-admin binding on the worker service account
  3. Check worker logs and file activity for unexpected reads of service account tokens or host paths

Timeline

  1. 1 Nov 2026, 13:18 UTC
    Publicly disclosed
  2. 1 Nov 2026, 13:18 UTC
    Reported by NVD · NVD
  3. 1 Nov 2026, 13:21 UTC
    Picked up by Zero Radar

Sources 1 report, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-120307
CVSS
9.9 / 10
Disclosed
1 Nov 2026, 13:18 UTC
On Zero Radar
1 Nov 2026, 13:21 UTC (3 min after disclosure)
Last change
1 Nov 2026, 13:21 UTC

The plain-language parts and the attack diagram were written by an AI model (claude-haiku-5-5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Beta9 worker file API lets tenants reach worker host files · Zero Radar