External risk intelligence

Beta9 Volume Path Traversal Allows Tenant Data Access.

CVE advisorySeverity: CRITICAL (CVSS 9.9)

CVE-2026-120308

The vulnerability exists in a gateway and worker component used for deploying functions, endpoints, and task queues. These services are typically deployed as internet-facing infrastructure to facilitate cloud-based application development and execution, making the management and control interfaces for these workspaces commonly reachable in cloud-native deployment environments.

Path Traversal

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This vulnerability in the Beta9 platform allows a malicious tenant to access and modify data belonging to other tenants by manipulating how data volumes are attached to deployed functions or tasks. The issue stems from insufficient validation of volume identifiers, which could permit unauthorized access to sensitive information stored on the same machine. The main concern is confirming relevance and exposure to your specific tenant configurations.

Tenants can access and alter other tenants' data.
It impacts data privacy and system integrity.
Confirm this platform is used and assess your exposure.

Attack Path

How an attacker could exploit the issue

An attacker with workspace access can manipulate volume identifiers when deploying functions or tasks, tricking the gateway into creating an insecure path to a worker's filesystem. This allows the attacker to read and write files on the worker, potentially accessing or altering data from other tenants' volumes stored on the same machine.

Requires authenticated workspace access.
Attacker crafts volume identifier.
Access to other tenants' data.

Live Threat

Current exploitation, exposure, and threat context

When supported by the advisory, a malicious tenant could potentially access and modify files on the worker's filesystem, including data from other tenants' volumes. This could occur if a tenant with a workspace token crafts a special volume identifier to navigate to unintended directories on the worker machine.

Tenant data on shared machine.
Malicious volume identifier usage.
Unauthorized data access and modification.

Operational Fix

Recommended remediation, mitigation, and detection steps

Application and platform teams are likely responsible for addressing this vulnerability, as it affects core deployment components. The immediate priority is to identify all instances of the affected gateway and worker, determine their exposure and business criticality, and confirm the accountable ownership for each deployment before planning remediation.

Identify affected gateway and worker deployments.
Verify reachability and business criticality.
Plan remediation based on identified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Beta9 platform and its components?

Beta9 is a cloud-native platform used for deploying functions, endpoints, and task queues. It relies on a gateway to manage requests and worker components to execute the code. These workers act as the runtime environment, housing workspaces where data volumes are attached to perform necessary tasks.

How does CVE-2026-120308 cause a security weakness?

This is a path traversal vulnerability, classified as CWE-22 and CWE-668. It occurs because the gateway fails to verify if a volume identifier belongs to the requesting workspace. By using specific characters, an attacker can trick the system into building a file path that escapes its intended directory, granting unauthorized read and write access to the worker's filesystem.

Does any specific action trigger this vulnerability?

The issue is triggered when a user with workspace access deploys a function, endpoint, or task queue while providing a maliciously crafted volume identifier. Note that simply having a workspace does not trigger the bug; the attacker must actively manipulate the configuration of a new or existing deployment to force the gateway to mount an unauthorized directory.

Why is this considered a relevant threat?

Halo Surface Signal indicates that Beta9 gateways and workers are frequently deployed as internet-facing infrastructure. Because these components facilitate cloud-based execution, they are often reachable, increasing the likelihood that an attacker with a workspace token could attempt to access or modify data belonging to other tenants on the same worker machine.

What are the first steps to address this vulnerability?

You should immediately audit your infrastructure to locate all active instances of the Beta9 gateway and worker components. Once identified, prioritize updating to gateway version 0.1.776 and worker version 0.1.756 or later. These versions include mandatory validation checks that ensure volume identifiers and mount paths are properly restricted to the authorized workspace.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.