External risk intelligence

Beta9 Worker Sandbox File API Path Traversal Leading to Root Access

CVE advisorySeverity: CRITICAL (CVSS 9.9)

CVE-2026-120307

The vulnerability exists in a worker component that processes file API requests within a sandbox environment. While the API is accessible to authenticated tenants within the platform, it is typically an internal component managed by the service provider rather than a public-facing service directly exposed to the open internet. Access requires existing tenant authentication, limiting its external reach.

Path Traversal

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This vulnerability affects a worker component responsible for handling sandbox file operations. An authenticated user with a running sandbox could potentially gain root-level access to files on the hosting worker, including other tenants' data and sensitive system files. This could lead to unauthorized data access and manipulation.

Sensitive files accessible by authenticated users.
Allows tenant access to host worker files.
Confirm relevance and verify exposure.

Attack Path

How an attacker could exploit the issue

An attacker with a workspace token and an active sandbox could leverage the Beta9 worker's file API to access files outside the container. By manipulating file paths to traverse directories or follow symbolic links, an attacker can reach arbitrary locations on the worker host. This allows them to read, write, list, and delete files as root, potentially affecting other tenants' data and gaining access to sensitive credentials like Kubernetes service account tokens.

Requires authenticated tenant access.
Triggers when processing file API requests.
Risk of host file access and credential theft.

Live Threat

Current exploitation, exposure, and threat context

A tenant with a workspace token and a running sandbox could gain root-level access on the hosting worker. This could allow them to read, write, list, and delete files on the worker's filesystem, potentially affecting other tenants' data or sensitive system files. In some configurations, this access might extend to reading Kubernetes service account tokens.

Worker filesystem access and control.
Malicious path manipulation.
Unauthorized data access and modification.

Operational Fix

Recommended remediation, mitigation, and detection steps

Platform and infrastructure teams are likely responsible for addressing this vulnerability, given that it affects a worker component and its file API. The first practical step involves identifying all instances of the affected worker, confirming their reachability and criticality to business operations, and then locating the accountable owner for remediation planning.

Platform and infrastructure teams own the issue.
Verify worker instances, reachability, and criticality.
Plan remediation with vendor coordination.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Beta9 worker component?

Beta9 is a cloud-native platform that provides isolated environments, known as sandboxes, for running workloads. The worker component manages these sandboxes and handles essential file system tasks like uploading, downloading, and listing files for tenants. It acts as the bridge between the restricted container environment and the underlying host system, ensuring files are accessed correctly during workspace operations.

How does CVE-2026-120307 work?

This vulnerability is a path traversal and symbolic link issue classified under CWE-22, CWE-23, and CWE-59. It occurs because the worker's file API does not strictly restrict file operations to the intended container boundaries. By crafting specific file paths or using symbolic links, an attacker can bypass these safety checks to read, write, or delete arbitrary files anywhere on the host system, effectively escaping the sandbox to operate with root-level permissions.

What triggers this vulnerability?

An attacker must have an active workspace token and a running sandbox to interact with the file API. The bug is triggered when the worker processes malicious path requests that escape the directory constraints. It is important to note that simply having a sandbox is not enough; the attacker must intentionally submit manipulated paths that exploit the helper function's failure to resolve directories or symlinks securely.

Is my environment at risk from this CVE?

Halo Surface Signal indicates a 'Possible' risk for this vulnerability. Because the affected worker component is usually an internal service managed by providers, it is not typically exposed directly to the open internet. However, since the API is reachable by any authenticated tenant, the risk centers on whether a malicious user can gain access to your infrastructure's sandbox environment.

What should I do to secure my system?

If you operate the Beta9 worker, prioritize upgrading to version 0.1.756 or later. This update introduces stricter path validation using os.OpenRoot, which ensures that file operations are cryptographically and logically confined within the sandbox. Coordinate with your platform and infrastructure teams to inventory your worker instances and schedule the deployment of this update to remediate the potential for host-level file access.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.