Beta9 is vulnerable to a Build Worker Sandbox Escape via Chroot-only Buildah Isolation

Summary

Beta9 workers before 0.1.756 run each tenant image build step with Buildah using BUILDAH_ISOLATION=chroot, without passing --isolation. This leaves the step sharing the worker pod's PID, network, IPC and user namespaces, running as uid 0 with CAP_DAC_OVERRIDE, so a tenant with any workspace token can reach the worker's filesystem through /proc/1/root in a single image build. The CVSS score is 9.9 (critical), and the issue was discovered by Natan Nehorai of the JFrog Security Research Team.

Mitigation

The source does not state a fix yet. Check the original advisory for updates.

Related items

• MediumGHSA-j656-3hf2-fvjc: DBHub: MySQL and MariaDB comment interpretation bypasses read-only SQL validationSimilar attack · GitHub Advisory Database
• MediumCritical Langflow Flaws Could Let Unauthenticated Attackers Run Code on ServersSimilar attack · The Hacker News
• LowChainalysis Discloses Data Breach Following AI-Driven CyberattackSimilar attack · SecurityWeek
• CriticalBeta9 is vulnerable to Host Filesystem Exposure via Volume Path TraversalSimilar attack · JFrog Security Research (Vulnerabilities)
• CriticalBeta9 is vulnerable to a Container Escape via Unvalidated Sandbox File PathsSimilar attack · JFrog Security Research (Vulnerabilities)