CVE-2026-120307

Name of the Vulnerable Software and Affected Versions Beam Cloud Beta9 Worker versions prior to 0.1.756

Description The Beta9 worker serves the sandbox file API from outside the container. The getHostPathFromContainerPath function converts a tenant's container path into a worker path. If the unresolved path starts with a mount destination, such as the default upload mount at /tmp/.beta9, the remainder is joined using filepath.Join, which cleans parent-directory segments after the prefix check. A sufficient sequence of these segments allows access to any absolute path on the worker. Additionally, paths that do not match a mount are joined to the container root and opened in the worker's filesystem, meaning absolute symbolic links are followed against the worker root. This issue affects the upload, download, stat, list, find-in-files, replace-in-files, and delete-file operations. A tenant with a workspace token and a running sandbox can read, write, list, and delete files on the hosting worker as root, including files belonging to other tenants. A proof of concept demonstrated the ability to download the worker pod's Kubernetes service account token, which in shipped remote-node manifests is bound to cluster-admin.

Recommendations Update Beam Cloud Beta9 Worker to version 0.1.756 or later. Restrict untrusted sandbox access and safeguard workspace tokens. Check service-account privileges and revoke exposed credentials if necessary.