Beta9 Worker: Sandbox path traversal (CVE-2026-120307)

Beta9 worker versions prior to 0.1.756 are vulnerable to a path traversal flaw in the sandbox file API due to improper sanitization in the getHostPathFromContainerPath function. Attackers with a valid workspace token and an active sandbox can perform unauthorized file operations on the host worker filesystem. This access can be used to read or modify data belonging to other tenants and, in cases where the worker pod is assigned cluster-admin permissions, can lead to full cluster compromise. The vulnerability is confirmed to allow reading the Kubernetes service account token.

Attack Chain

1. Attacker gains access to a valid tenant workspace token.
2. Attacker initiates or uses an active sandbox session.
3. Attacker crafts a file path containing sequences that bypass the mount destination prefix check.
4. The getHostPathFromContainerPath function resolves the malicious path to an absolute path on the host worker filesystem.
5. The file API calls (Upload, download, stat, list, find-in-files, replace-in-files, or delete-file) interact with the resolved host path.
6. The attacker reads or modifies sensitive host files, such as the Kubernetes service account token.
7. If applicable, the attacker uses the stolen service account token to achieve cluster-admin access.

Impact

An attacker can achieve full read, write, and delete access to the host worker filesystem as root. This allows for the exfiltration of data from other tenants on the same worker and potential cluster-wide privilege escalation if the worker pod is configured with elevated Kubernetes permissions.

Recommendation

• Upgrade the Beta9 worker to version 0.1.756 or later immediately to implement os.OpenRoot for sandbox file operations.
• Audit Kubernetes RBAC configurations for worker pods to ensure the principle of least privilege is applied, specifically restricting cluster-admin access for worker pods.
• Review access logs for the sandbox file API for anomalous path requests involving multiple parent-directory segments.