39 matches found
CVE-2026-120306
Beta9 turns each shell command in a tenant image definition into a Dockerfile RUN line and executes it with Buildah on the build worker. The worker image sets BUILDAHISOLATION=chroot, and no buildah invocation passes --isolation, so the step only changes its filesystem root. It keeps the worker...
CVE-2026-120308
A Beta9 tenant can attach a volume when deploying a function, endpoint, or task queue. The gateway builds the host path by joining the shared volumes root, the workspace name, and the volume identifier from the stub configuration. Nothing checks that the identifier names a volume that workspace...
CVE-2026-120307
The Beta9 worker serves the sandbox file API from outside the container. getHostPathFromContainerPath turns the tenant's container path into a worker path. If the unresolved path starts with a mount destination, including the default upload mount at /tmp/.beta9, the remainder is joined onto that...
EUVD-2026-114842
A Beta9 tenant can attach a volume when deploying a function, endpoint, or task queue. The gateway builds the host path by joining the shared volumes root, the workspace name, and the volume identifier from the stub configuration. Nothing checks that the identifier names a volume that workspace...
CVE-2026-120308 Beta9 host filesystem exposure via volume path traversal
A Beta9 tenant can attach a volume when deploying a function, endpoint, or task queue. The gateway builds the host path by joining the shared volumes root, the workspace name, and the volume identifier from the stub configuration. Nothing checks that the identifier names a volume that workspace...
CVE-2026-120308
A Beta9 tenant can exploit a path traversal vulnerability when deploying a function, endpoint, or task queue to access the host filesystem. The vulnerability occurs because the gateway joins the shared volumes root, workspace name, and volume identifier without verifying that the workspace owns t...
CVE-2026-120307 Beta9 container escape via unvalidated sandbox file paths
The Beta9 worker serves the sandbox file API from outside the container. getHostPathFromContainerPath turns the tenant's container path into a worker path. If the unresolved path starts with a mount destination, including the default upload mount at /tmp/.beta9, the remainder is joined onto that...
EUVD-2026-114841
The Beta9 worker serves the sandbox file API from outside the container. getHostPathFromContainerPath turns the tenant's container path into a worker path. If the unresolved path starts with a mount destination, including the default upload mount at /tmp/.beta9, the remainder is joined onto that...
CVE-2026-120307
The Beta9 worker is vulnerable to a container escape because the sandbox file API serves paths from outside the container. The root cause lies in the getHostPathFromContainerPath function, which incorrectly joins paths using filepath.Join after a prefix check. This allows an attacker to use a lon...
EUVD-2026-114840
Beta9 turns each shell command in a tenant image definition into a Dockerfile RUN line and executes it with Buildah on the build worker. The worker image sets BUILDAHISOLATION=chroot, and no buildah invocation passes --isolation, so the step only changes its filesystem root. It keeps the worker...
CVE-2026-120306 Beta9 build sandbox escape via chroot-only isolation
Beta9 turns each shell command in a tenant image definition into a Dockerfile RUN line and executes it with Buildah on the build worker. The worker image sets BUILDAHISOLATION=chroot, and no buildah invocation passes --isolation, so the step only changes its filesystem root. It keeps the worker...
CVE-2026-120306
The Beta9 build worker is vulnerable to a sandbox escape because it executes tenant shell commands using Buildah with chroot-only isolation . Due to the BUILDAH_ISOLATION=chroot setting and a lack of explicit --isolation flags, the build process retains the worker pod's PID, network, IPC, and use...
PT-2026-134901
Name of the Vulnerable Software and Affected Versions Beta9 build worker versions prior to 0.1.756 Description A sandbox escape exists in the image build process where shell commands in a tenant image definition are executed using Buildah with BUILDAH ISOLATION=chroot. Because the process retains...
PT-2026-134902
Name of the Vulnerable Software and Affected Versions Beam Cloud Beta9 Worker versions prior to 0.1.756 Description The Beta9 worker serves the sandbox file API from outside the container. The getHostPathFromContainerPath function converts a tenant's container path into a worker path. If the...
PT-2026-134903
Name of the Vulnerable Software and Affected Versions Beam Cloud Beta9 Gateway versions prior to 0.1.776 Beam Cloud Beta9 Worker versions prior to 0.1.756 Description An issue exists where a tenant with a workspace token can attach a volume when deploying a function, endpoint, or task queue. The...
Exploit for Improper Input Validation in Siemens 6Bk1602-0Aa12-0Tp0_Firmware
EHAX Open House — Log4Shell Demo Kit A safe, self-contained d...
Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: wildfly-core (UTSA-2026-016736)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-016736 advisory. Apache Log4j2 2.0-beta9 through 2.15.0 excluding security releases 2.12.2, 2.12.3, and 2.3.1 JNDI features used in configuration, log messages, and parameters do not...
K000160700: Log4J vulnerability CVE-2025-68161
Security Advisory Description The Socket Appender in Apache Log4j Core versions 2.0-beta9 through 2.25.2 does not perform TLS hostname verification of the peer certificate, even when the verifyHostName https:// logging.apache . org/log4j/2.x/manual/appenders/network...
