CVE-2026-120306 Beta9 build sandbox escape via chroot-only isolation

Beta9 turns each shell command in a tenant image definition into a Dockerfile RUN line and executes it with Buildah on the build worker. The worker image sets BUILDAHISOLATION=chroot, and no buildah invocation passes --isolation, so the step only changes its filesystem root. It keeps the worker...

CVE-2026-120306

The Beta9 build worker is vulnerable to a sandbox escape because it executes tenant shell commands using Buildah with chroot-only isolation . Due to the BUILDAH_ISOLATION=chroot setting and a lack of explicit --isolation flags, the build process retains the worker pod's PID, network, IPC, and use...