Beta9 CVE-2026-120308

Requires an authenticated tenant holding a valid workspace token on a Beta9 deployment (PR:L). The attacker deploys a function, endpoint, or task queue and attaches a volume whose identifier contains parent-directory ('..') segments, so the gateway-built host path (shared volumes root + workspace name + attacker-controlled identifier) collapses to the worker's filesystem root; the gateway performs no ownership check that the identifier names a volume the workspace owns. The mount is bind-mounted read-write unless the volume was explicitly marked read-only, which is the only in-product limit on write access. Cross-tenant impact (reading/writing other tenants' volumes) requires a multi-tenant worker where other tenants' data is colocated on the same machine. Affected: gateway <=0.1.769 and worker <=0.1.745 (confirmed vulnerable); the fix also re-checks stubs persisted before validation existed.

Multiple signals align on genuine high priority, though not all signals are present. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, base 9.9) describes a network-reachable, low-complexity flaw needing only low privileges (a tenant workspace token) with a scope change and total confidentiality, integrity, and availability impact - consistent with the description of a path-traversal (CWE-22) tenant isolation break. The vuln.today decision label is act_now and the vendor has shipped a patch, reinforcing urgency. However, no EPSS score was provided in the input, so exploitation probability cannot be quantified, and there is no CISA KEV listing, so this is NOT confirmed actively exploited. No working public exploit is identified in the references (they are vendor patch/release artifacts only); the fix's own test cases demonstrate the traversal payload (e.g. id "../../..") but that is remediation test code, not a weaponized exploit. The key caveat: PR:L correctly reflects that an attacker must already hold a valid workspace token on a multi-tenant Beta9 deployment - this is an authenticated tenant-to-tenant escalation, not anonymous internet exploitation, which tempers raw-score urgency for single-tenant or non-exposed deployments. For any shared/multi-tenant Beta9 platform this is a real priority; for isolated single-tenant use the cross-tenant blast radius does not apply.

A malicious or compromised tenant on a shared Beta9 platform deploys a function, endpoint, or task queue and attaches a volume whose identifier contains parent-directory segments (e.g. "../../.."); the gateway joins this into a host path that collapses to the worker's filesystem root, and the worker bind-mounts it read-write into the attacker's sandbox. The attacker can then read and modify the worker's files and other tenants' volumes stored on that machine. No public working exploit is identified at time of analysis, and exploitation requires a valid workspace token.