Beta9: Sandbox escape via volume mount path traversal (CVE-2026-120308)

A path traversal vulnerability exists in Beta9 gateway and worker components where volume identifiers are not validated for ownership or path constraints. By providing a volume identifier containing parent-directory traversal sequences, an authenticated tenant can cause the worker to bind-mount directories from the host filesystem into their sandbox. This grants read/write access to worker files and data belonging to other tenants. This vulnerability is confirmed in gateway version 0.1.769 and worker version 0.1.745.

Impact

A tenant with a workspace token can perform unauthorized read and write operations on the underlying worker filesystem, potentially resulting in cross-tenant data exposure and host system compromise.

Recommendation

Patch all Beta9 deployments by upgrading the gateway component to version 0.1.776 or later and the worker component to version 0.1.756 or later. These versions implement strict validation of volume identifiers and ownership checks.