{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/beta9-worker-prior-to-0.1.756/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":9.9,"id":"CVE-2026-120306"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Beta9 worker (prior to 0.1.756)"],"_cs_severities":["critical"],"_cs_tags":["container-security","privilege-escalation","vulnerability"],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eBeta9 worker pods perform image builds using Buildah with insufficient isolation. Tenant-provided shell commands are executed as RUN instructions within the worker, which shares PID, network, IPC, and user namespaces with the build worker container. The worker runs as UID 0 with CAP_DAC_OVERRIDE. Access to /proc/1/root allows the build process to interact with the worker's filesystem, which contains runc, buildah, and runsc binaries, Kubernetes service account tokens, and mounted host directories.\u003c/p\u003e\n","date_modified":"2026-11-01T14:53:46Z","date_published":"2026-11-01T14:53:46Z","id":"https://feed.craftedsignal.io/briefs/2026-11-beta9-worker-breakout/","summary":"Beta9 worker pods execute tenant image definition shell commands with inadequate isolation, allowing access to the worker's filesystem and privileged resources.","title":"Beta9: Build worker isolation deficiency (CVE-2026-120306)","url":"https://feed.craftedsignal.io/briefs/2026-11-beta9-worker-breakout/"}],"language":"en","title":"CraftedSignal Threat Feed - Beta9 Worker (Prior to 0.1.756)","version":"https://jsonfeed.org/version/1.1"}