{"data":{"id":"4381b861-22b7-4abd-a294-c5406ee4c0c6","title":"Beta9 is vulnerable to a Container Escape via Unvalidated Sandbox File Paths","summary":"Beta9 worker versions below 0.1.756 let a tenant holding a workspace token and one running sandbox escape the container through the sandbox file API. The getHostPathFromContainerPath helper in pkg/worker/container_server.go joins tenant-supplied paths onto worker paths, so traversal segments and absolute symbolic links reach any file on the worker as root, including other tenants' files and the worker pod's Kubernetes service account token, which is bound to cluster-admin in the shipped remote-node manifests.","solution":"Fixed in worker 0.1.756, which opens these paths with os.OpenRoot so parent-directory and symlink lookups stay inside the container root or mount source, refuses writes to read-only mounts, and does not write through a symlink swapped in after path resolution.","labels":["security"],"sourceUrl":"https://research.jfrog.com/vulnerabilities/beta9-is-vulnerable-to-a-container-escape-via-unvalidated-sandbox-file-paths-cve-2026-120307/","publishedAt":"2026-11-01T00:00:00.000Z","cveId":null,"cweIds":null,"cvssScore":null,"cvssSeverity":null,"severity":"critical","attackType":["other"],"issueType":"vulnerability","affectedPackages":null,"affectedPackageNames":null,"affectedPackageRefs":null,"affectedVendors":[],"affectedVendorsRaw":["Beta9"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":null,"cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":null,"epssScore":null,"epssCheckedAt":null,"kevDateAdded":null,"advisoryAliases":null,"affectedPackagesSource":null,"affectedPackagesCheckedAt":null,"patchAvailable":null,"disclosureDate":"2026-11-01T00:00:00.000Z","fixReleasedAt":null,"daysToFix":null,"fixCheckedAt":null,"capecIds":null,"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality","integrity","availability"],"aiComponentTargeted":"inference","llmSpecific":false,"classifierConfidence":0.85,"researchCategory":null,"atlasIds":null,"fixes":[]}}