A Beta9 API permitted tenant-controlled volume identifier/path traversal to influence the host bind-mount source selected for a sandbox. JFrog reports CVE-2026-120308 allowing read/write mount exposure of worker filesystem content in the demonstrated deployment. Exact privilege and follow-on access depend on worker mounts, not all Kubernetes clusters. The…
Inspect the ClaimsCase · DiggingBeagle record
Beta9 tenant volume traversal exposed worker filesystem contents through bind mounts
A Beta9 API permitted tenant-controlled volume identifier/path traversal to influence the host bind-mount source selected for a sandbox. JFrog reports CVE-2026-120308 allowing read/write mount exposure of worker filesystem content in the demonstrated deployment.
Public disclosure: Nov 1, 2026
Scope
Reported security vulnerability; exploitation prerequisites and tested version scope matter. No real-world exploitation is established unless separately reported.
Assessment profile
Assessment method- Setting
- research demonstration
- Exploitation
- demonstrated
- Evidence
- Grade B
- Remediation
- patch available
- AI role
- AGAINST AI
Basis and provenance
research demonstration; demonstrated. The cited primary disclosure supports the specific sequence and boundaries described here: A Beta9 tenant prepares a function or task with a volume reference containing parent-directory segments. The evidence does not independently establish consequences beyond the record's supported outcome; a numerical impact band cannot be justified from the available evidence. Evidence grade B reflects the source attribution and independent verification limits.
Assessed Nov 7, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-DB07-133-OUTCOME · CLM-DB07-133-MECHANISM · CLM-ENR-DB07-011-BETA9-MOUNT-DUAL-FIX · JFrog: Beta9 volume path traversal, CVE-2026-120308
At a glance
Use server-resolved immutable volume IDs and reject any tenant-controlled path component before constructing mounts.
Read the implicationsLocal controlled, actual multi-tenant cloud compromise not shown; separate build/file API issues.
Limits and uncertaintyFull account
A Beta9 API permitted tenant-controlled volume identifier/path traversal to influence the host bind-mount source selected for a sandbox.
JFrog reports CVE-2026-120308 allowing read/write mount exposure of worker filesystem content in the demonstrated deployment. Exact privilege and follow-on access depend on worker mounts, not all Kubernetes clusters.
The second Beta9 issue is at mount construction, not the sandbox file API. The gateway assembled a worker-side bind-mount source using tenant-provided volume identifiers without checking ownership or parent-directory traversal. JFrog reproduced a configuration where the container saw the worker's root directory and could read files outside its intended tenant volume. The public report names the tested gateway 0.1.769 and worker 0.1.745, and fixes in gateway 0.1.776 plus worker 0.1.756. A gateway-only update would leave previously prepared stubs or worker behavior unprotected; both components require the corrected validation. The result was a laboratory reproduction, not confirmed compromise of a live multitenant deployment.
Here the boundary fails while constructing a sandbox mount, before a normal filesystem API read occurs. The tenant-controlled volume identifier changes the host-side path selected for mounting; a subsequent sandbox can then see files outside its assigned volume. JFrog names gateway 0.1.776 and worker 0.1.756 as the corrected component versions. Upgrading only one side is not evidence that the entire mount-building chain is safe. The separate Beta9 file-API flaw needs its own regression because it reaches worker files by a different route.
Mechanism and trust boundary
- 01
A Beta9 tenant prepares a function or task with a volume reference containing parent-directory segments.
- 02
The gateway builds a bind-mount source path without enforcing workspace ownership and confinement.
- 03
The worker mounts the resolved host path into the sandbox, exposing worker filesystem entries read-write unless explicitly limited.
Claims & evidence
CLM-DB07-133-OUTCOMEJFrog reports CVE-2026-120308 allowing read/write mount exposure of worker filesystem content in the demonstrated deployment. Exact privilege and follow-on access depend on worker mounts, not all Kubernetes clusters.supported
Basis: reported finding
- supportsJFrog: Beta9 volume path traversal, CVE-2026-120308primary disclosure
JFrog advisory CVE-2026-120308; volume identifier traversal and host mount
CLM-DB07-133-MECHANISMA Beta9 API permitted tenant-controlled volume identifier/path traversal to influence the host bind-mount source selected for a sandbox.supported
Basis: reported finding
- supportsJFrog: Beta9 volume path traversal, CVE-2026-120308primary disclosure
JFrog advisory CVE-2026-120308; volume identifier traversal and host mount
CLM-ENR-DB07-011-BETA9-MOUNT-DUAL-FIXJFrog reports that the Beta9 tenant volume mount traversal requires fixing both the gateway and the worker paths, with corrected gateway version 0.1.776 and corrected worker version 0.1.756. Updating only one component does not establish the full path is closed.supported
Basis: reported finding
- supportsJFrog: Beta9 volume path traversal, CVE-2026-120308primary disclosure
CVE-2026-120308: volume mount traversal, gateway and worker fixes
Implications
Use server-resolved immutable volume IDs and reject any tenant-controlled path component before constructing mounts.
Unknowns and contradictions
- Local controlled, actual multi-tenant cloud compromise not shown; separate build/file API issues.
Sources and citation
Material revision history
- Nov 7, 2026 · Published version · first publication · revision 227