CVE-2026-120306: Sandbox Escape in Beta9

Sandbox escape in Beta9 via chroot isolation: access to K8s tokens and host filesystem. Patch 0.1.756 available.

CVE-2026-120306 is a sandbox escape vulnerability in Beta9 build workers. The system executes tenant shell commands via Buildah with insufficient isolation (chroot). The container retains the worker pod's namespaces (PID, network, IPC, user), runs as uid 0 with CAP_DAC_OVERRIDE, and accesses /proc/1/root (writable worker filesystem) containing runc/buildah/runsc binaries, Kubernetes service account token, and mounted host directories. A tenant with workspace token reaches this state via a single image build, since Clip v2 is the default.

Declared severity is critical with CVSS 9.9. The vulnerability enables sandbox escape from the tenant container into the worker pod and underlying infrastructure: access to Kubernetes tokens, critical binaries, and mounted filesystems. A malicious tenant can read the service account token and compromise peer tenant containers. The fix is available in worker 0.1.756 (published 2026-11-01), where Buildah RUN steps use OCI isolation with private namespaces.

Teams responsible for Beta9 must verify current worker version, plan upgrade to 0.1.756 with maximum priority (security patch, not breaking change), and if delayed, monitor anomalous activity in tenant pods and Kubernetes token access. Post-upgrade, verify OCI isolation is active for Buildah RUN steps. Review recent invocation logs for signs of prior exploitation.

At a glance

What: Beta9 build worker executes tenant shell commands via Buildah with insufficient isolation (chroot). The container retains the worker pod's namespaces (PID, network, IPC, user), runs as uid 0 with CAP_DAC_OVERRIDE, and accesses /proc/1/root (writable worker filesystem) containing runc/buildah/runsc binaries, Kubernetes service account token, and mounted host directories. A tenant with workspace token reaches this state via a single image build.
Severity: CVSS 9.9 (critical). Sandbox escape exposing Kubernetes tokens, critical binaries, and worker pod filesystem. A malicious tenant accesses the service account token and potentially compromises peer tenant containers or underlying infrastructure.
Affected versions: Beta9 worker versions prior to 0.1.756. Clip v2 layered builds is the default, so all users submitting image builds are potentially exposed.
Fix: Worker 0.1.756 uses OCI isolation with private namespaces (PID, IPC, network) for Buildah RUN steps, including WORKDIR mkdir. Tenant ARG values are passed only into the build container. Immediate upgrade recommended.
Status: Published 2026-11-01. Fix available in stable version 0.1.756. Public exploits not reported in available data, but given critical importance, patch is urgent.
Action: 1. Verify current Beta9 worker version. 2. Plan upgrade to 0.1.756 with maximum priority (security patch, not breaking change). 3. If delayed, monitor anomalous activity in tenant pods and Kubernetes token access. 4. Post-upgrade, verify OCI isolation is active for Buildah RUN steps.

Sources: NVD, CVE-2026-120306

← All articles