A Beta9 sandbox user could supply unvalidated filesystem paths to service file APIs, causing operations to resolve outside the intended tenant sandbox into the worker environment. JFrog reports that CVE-2026-120307 exposes worker Kubernetes service-account token material in a controlled reproduction. The issue crosses a sandbox-to-worker boundary; it is…
Inspect the ClaimsCase · DiggingBeagle record
Beta9 sandbox file paths reached Kubernetes worker service-account material
A Beta9 sandbox user could supply unvalidated filesystem paths to service file APIs, causing operations to resolve outside the intended tenant sandbox into the worker environment. JFrog reports that CVE-2026-120307 exposes worker Kubernetes service-account token material in a controlled reproduction.
Public disclosure: Nov 1, 2026
Scope
Reported security vulnerability; exploitation prerequisites and tested version scope matter. No real-world exploitation is established unless separately reported.
Assessment profile
Assessment method- Setting
- research demonstration
- Exploitation
- demonstrated
- Evidence
- Grade B
- Remediation
- patch available
- AI role
- AGAINST AI
Basis and provenance
research demonstration; demonstrated. The cited primary disclosure supports the specific sequence and boundaries described here: A legitimate tenant supplies a crafted sandbox file path to a Beta9 file API while one sandbox runs. The evidence does not independently establish consequences beyond the record's supported outcome; a numerical impact band cannot be justified from the available evidence. Evidence grade B reflects the source attribution and independent verification limits.
Assessed Nov 7, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-DB07-132-OUTCOME · CLM-DB07-132-MECHANISM · CLM-ENR-DB07-010-BETA9-FILE-API-FIX · JFrog: Beta9 sandbox path escape, CVE-2026-120307
At a glance
Bind file API paths to sandbox-owned directory handles and eliminate worker credentials from tenant-reachable mounts.
Read the implicationsProof of reading token, not exercising cluster takeover; no wild exploited deployment. Distinct from already-published Beta9 build chroot case.
Limits and uncertaintyFull account
A Beta9 sandbox user could supply unvalidated filesystem paths to service file APIs, causing operations to resolve outside the intended tenant sandbox into the worker environment.
JFrog reports that CVE-2026-120307 exposes worker Kubernetes service-account token material in a controlled reproduction. The issue crosses a sandbox-to-worker boundary; it is not a blanket cluster takeover assertion.
The trust-boundary failure occurs in the Beta9 worker, outside the tenant container. The service's getHostPathFromContainerPath helper checked a mount prefix before joining tenant-controlled relative path components, and subsequent normalization could select files on the worker instead of the sandbox root. JFrog demonstrated a read of the worker pod's Kubernetes service-account token through the file API. The security consequence depends on that token's permissions; the disclosed manifests assign cluster-admin, but the report did not demonstrate an actual cluster takeover. JFrog identifies worker 0.1.756 as the fix, using confined filesystem roots. The necessary precondition is an authenticated workspace tenant with a running sandbox, not anonymous access to every installation.
This path crosses from a tenant's sandbox file API into worker-owned paths, making the worker's Kubernetes service-account material reachable in JFrog's controlled test. It is distinct from the related volume identifier flaw, where the gateway and worker chose an unsafe host bind-mount source. JFrog identifies worker 0.1.756 for the file-API correction. A meaningful regression should use two isolated tenants and check which service account, filesystem and Kubernetes permissions are actually exposed, without treating a token read as proven cluster takeover.
Mechanism and trust boundary
- 01
A legitimate tenant supplies a crafted sandbox file path to a Beta9 file API while one sandbox runs.
- 02
The worker maps the path onto its own filesystem after a prefix check that precedes normalization or symlink resolution.
- 03
The read crosses from tenant sandbox authority to worker pod files, including a Kubernetes service-account token in the controlled test.
Claims & evidence
CLM-DB07-132-OUTCOMEJFrog reports that CVE-2026-120307 exposes worker Kubernetes service-account token material in a controlled reproduction. The issue crosses a sandbox-to-worker boundary; it is not a blanket cluster takeover assertion.supported
Basis: reported finding
- supportsJFrog: Beta9 sandbox path escape, CVE-2026-120307primary disclosure
JFrog advisory CVE-2026-120307; path validation and service account token
CLM-DB07-132-MECHANISMA Beta9 sandbox user could supply unvalidated filesystem paths to service file APIs, causing operations to resolve outside the intended tenant sandbox into the worker environment.supported
Basis: reported finding
- supportsJFrog: Beta9 sandbox path escape, CVE-2026-120307primary disclosure
JFrog advisory CVE-2026-120307; path validation and service account token
CLM-ENR-DB07-010-BETA9-FILE-API-FIXJFrog attributes Beta9 worker file-API path traversal to CVE-2026-120307 and identifies worker version 0.1.756 as the corrected release. The demonstrated token read remained within the worker context.supported
Basis: reported finding
- supportsJFrog: Beta9 sandbox path escape, CVE-2026-120307primary disclosure
CVE-2026-120307: file API and fix in worker 0.1.756
Implications
Bind file API paths to sandbox-owned directory handles and eliminate worker credentials from tenant-reachable mounts.
Unknowns and contradictions
- Proof of reading token, not exercising cluster takeover; no wild exploited deployment. Distinct from already-published Beta9 build chroot case.
Sources and citation
Material revision history
- Nov 7, 2026 · Published version · first publication · revision 227