https://feed.craftedsignal.io/products/beta9-worker-prior-to-0.1.756/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioSun, 01 Nov 2026 14:53:46 +0000https://feed.craftedsignal.io/favicon-32x32.pnghttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svghttps://feed.craftedsignal.io/briefs/2026-11-beta9-worker-breakout/Sun, 01 Nov 2026 14:53:46 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-beta9-worker-breakout/Beta9 worker pods execute tenant image definition shell commands with inadequate isolation, allowing access to the worker's filesystem and privileged resources.<p>Beta9 worker pods perform image builds using Buildah with insufficient isolation. Tenant-provided shell commands are executed as RUN instructions within the worker, which shares PID, network, IPC, and user namespaces with the build worker container. The worker runs as UID 0 with CAP_DAC_OVERRIDE. Access to /proc/1/root allows the build process to interact with the worker's filesystem, which contains runc, buildah, and runsc binaries, Kubernetes service account tokens, and mounted host directories.</p> criticaladvisorycontainer-securityprivilege-escalationvulnerability