CVE-2026-120308

Summary

A path traversal flaw in the gateway's volume mount logic allows a Beta9 tenant with workspace-level credentials to escape sandbox isolation by providing a malicious volume identifier containing parent-directory segments (e.g., ../../), causing the worker to bind-mount arbitrary host paths—including other tenants' volumes—into the sandbox, enabling full read/write access to sensitive host files.

Exploitability

Exploitation requires only valid workspace-level credentials and the ability to deploy a stub with a crafted volume identifier; no user interaction or complex conditions are needed.

Blast radius

A compromised tenant can exfiltrate or modify any file on the worker host accessible to the sandbox, including volumes belonging to other tenants, leading to cross-tenant data theft, credential harvesting, or lateral movement within the infrastructure.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade gateway to version 0.1.776 or later and worker to version 0.1.756 or later to apply the validation fix that rejects volume identifiers not owned by the workspace before mounting.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.