36 matches found
CVE-2026-120308
A Beta9 tenant can attach a volume when deploying a function, endpoint, or task queue. The gateway builds the host path by joining the shared volumes root, the workspace name, and the volume identifier from the stub configuration. Nothing checks that the identifier names a volume that workspace...
CVE-2026-120306
Beta9 turns each shell command in a tenant image definition into a Dockerfile RUN line and executes it with Buildah on the build worker. The worker image sets BUILDAHISOLATION=chroot, and no buildah invocation passes --isolation, so the step only changes its filesystem root. It keeps the worker...
CVE-2026-120307
The Beta9 worker serves the sandbox file API from outside the container. getHostPathFromContainerPath turns the tenant's container path into a worker path. If the unresolved path starts with a mount destination, including the default upload mount at /tmp/.beta9, the remainder is joined onto that...
CVE-2026-120308
A Beta9 tenant can exploit a path traversal vulnerability when deploying a function, endpoint, or task queue to access the host filesystem. The vulnerability occurs because the gateway joins the shared volumes root, workspace name, and volume identifier without verifying that the workspace owns t...
CVE-2026-120308 Beta9 host filesystem exposure via volume path traversal
A Beta9 tenant can attach a volume when deploying a function, endpoint, or task queue. The gateway builds the host path by joining the shared volumes root, the workspace name, and the volume identifier from the stub configuration. Nothing checks that the identifier names a volume that workspace...
EUVD-2026-114842
A Beta9 tenant can attach a volume when deploying a function, endpoint, or task queue. The gateway builds the host path by joining the shared volumes root, the workspace name, and the volume identifier from the stub configuration. Nothing checks that the identifier names a volume that workspace...
CVE-2026-120307 Beta9 container escape via unvalidated sandbox file paths
The Beta9 worker serves the sandbox file API from outside the container. getHostPathFromContainerPath turns the tenant's container path into a worker path. If the unresolved path starts with a mount destination, including the default upload mount at /tmp/.beta9, the remainder is joined onto that...
CVE-2026-120307
The Beta9 worker is vulnerable to a container escape because the sandbox file API serves paths from outside the container. The root cause lies in the getHostPathFromContainerPath function, which incorrectly joins paths using filepath.Join after a prefix check. This allows an attacker to use a lon...
EUVD-2026-114841
The Beta9 worker serves the sandbox file API from outside the container. getHostPathFromContainerPath turns the tenant's container path into a worker path. If the unresolved path starts with a mount destination, including the default upload mount at /tmp/.beta9, the remainder is joined onto that...
CVE-2026-120306
The Beta9 build worker is vulnerable to a sandbox escape because it executes tenant shell commands using Buildah with chroot-only isolation . Due to the BUILDAH_ISOLATION=chroot setting and a lack of explicit --isolation flags, the build process retains the worker pod's PID, network, IPC, and use...
CVE-2026-120306 Beta9 build sandbox escape via chroot-only isolation
Beta9 turns each shell command in a tenant image definition into a Dockerfile RUN line and executes it with Buildah on the build worker. The worker image sets BUILDAHISOLATION=chroot, and no buildah invocation passes --isolation, so the step only changes its filesystem root. It keeps the worker...
EUVD-2026-114840
Beta9 turns each shell command in a tenant image definition into a Dockerfile RUN line and executes it with Buildah on the build worker. The worker image sets BUILDAHISOLATION=chroot, and no buildah invocation passes --isolation, so the step only changes its filesystem root. It keeps the worker...
Exploit for Improper Input Validation in Siemens 6Bk1602-0Aa12-0Tp0_Firmware
EHAX Open House — Log4Shell Demo Kit A safe, self-contained d...
Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: wildfly-core (UTSA-2026-016736)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-016736 advisory. Apache Log4j2 2.0-beta9 through 2.15.0 excluding security releases 2.12.2, 2.12.3, and 2.3.1 JNDI features used in configuration, log messages, and parameters do not...
K000160700: Log4J vulnerability CVE-2025-68161
Security Advisory Description The Socket Appender in Apache Log4j Core versions 2.0-beta9 through 2.25.2 does not perform TLS hostname verification of the peer certificate, even when the verifyHostName https:// logging.apache . org/log4j/2.x/manual/appenders/network...
SUSE CVE-2025-69820
Directory Traversal vulnerability in Beam beta9 v.0.1.521 allows a remote attacker to obtain sensitive information via the joinCleanPath function...
GO-2026-4390 Beam Exposes sensitive information via joinCleanPath function in github.com/beam-cloud/beta9
Beam Exposes sensitive information via joinCleanPath function in github.com/beam-cloud/beta9...
GHSA-73JG-4QH6-3F4G Beam Exposes sensitive information via joinCleanPath function
Directory Traversal vulnerability in Beam beta9 v.0.1.552 allows a remote attacker to obtain sensitive information via the joinCleanPath function...
CVE-2025-69820
Directory Traversal vulnerability in Beam beta9 v.0.1.521 allows a remote attacker to obtain sensitive information via the joinCleanPath function...
CVE-2025-69820
A Directory Traversal vulnerability exists in Beam beta9 (specifically versions v.0.1.521 and v.0.1.552 ), within the github.com/beam-cloud/beta9/pkg/abstractions/volume component. The root cause is located in the joinCleanPath function, which fails to properly validate input, allowing remote att...