CVE-2026-120306 Security Alert: CRITICAL Vulnerability

Urgent: CVE-2026-120306 requires immediate attention.

· 7 min read

Executive Summary

CVE-2026-120306 is a critical build-worker escape risk affecting Beta9 image builds. A tenant-controlled shell command in an image definition is translated into a Dockerfile RUN step and executed by Buildah on the worker. Because the worker runs Buildah with BUILDAH_ISOLATION=chroot and no explicit --isolation override, the build step can share the worker pod’s namespaces, run as uid 0, and access sensitive files through /proc/1/root. In practice, a tenant with a workspace token may be able to read secrets, service account tokens, build tooling, and mounted host paths from the worker container.

Fixed in worker 0.1.756. The patch switches Buildah RUN steps to OCI isolation with private PID, IPC, and network namespaces, and ensures tenant ARG values are only passed into the build container.

Immediate Action

  • Upgrade immediately to worker 0.1.756 or later. If you cannot patch right away, disable tenant image builds or route them to a quarantined, non-production worker pool.
  • Rotate credentials that may have been exposed on build workers: Kubernetes service account tokens, registry credentials, cloud keys, and any secrets mounted into the worker pod.
  • Review recent build activity for suspicious image definitions, unexpected shell commands, or builds submitted by low-trust workspace tokens.
  • Restrict access to the build API and workspace tokens until patched; limit who can submit image builds.
  • Check vendor guidance and release notes: TODO: vendor advisory / release notes.

Affected Versions

  • worker < 0.1.756 vulnerable
  • worker 0.1.756+ safe
  • Beta9 clip v2 layered builds are the default path that reaches the issue when a tenant submits an image build

Resolution Guide

Patch the worker image first. If you use Docker, Kubernetes, or a package-managed deployment, update to the fixed release and redeploy all build workers.

# Docker / container image
docker pull TODO_VENDOR/worker:0.1.756
docker stop beta9-worker
docker rm beta9-worker
docker run ... TODO_VENDOR/worker:0.1.756

# Kubernetes
kubectl set image deployment/beta9-worker worker=TODO_VENDOR/worker:0.1.756
kubectl rollout status deployment/beta9-worker

# Helm (if applicable)
helm upgrade beta9 TODO_CHART --set worker.image.tag=0.1.756

Linux package installs (if your deployment uses OS packages):

# apt
sudo apt-get update
sudo apt-get install --only-upgrade beta9-worker

# yum/dnf
sudo yum update beta9-worker
# or
sudo dnf upgrade beta9-worker

JavaScript / Python / Java ecosystem commands are only relevant if your app depends on a client or SDK that triggers builds; update those clients if they embed build submission logic:

# npm / yarn / pnpm
npm i @TODO_VENDOR/sdk@latest
yarn add @TODO_VENDOR/sdk@latest
pnpm add @TODO_VENDOR/sdk@latest

# pip / pipx
pip install -U TODO_VENDOR_sdk
pipx upgrade TODO_VENDOR_sdk

# Maven / Gradle
# Maven: update the dependency version in pom.xml to the fixed release
# Gradle:
implementation("TODO_VENDOR:beta9-sdk:TODO_FIXED_VERSION")

Hardening while you patch:

# Example: disable tenant image builds via feature flag
export BETA9_ENABLE_LAYERED_BUILDS=false

# Example: force isolated build mode if your deployment supports it
export BUILDAH_ISOLATION=oci

# Example: restrict worker privileges in Kubernetes
securityContext:
  privileged: false
  runAsUser: 1000
  allowPrivilegeEscalation: false

Minimal code/config fix pattern if you maintain the build wrapper:

// Before: inherited isolation and tenant-controlled shell execution
buildah run image -- sh -c "$TENANT_CMD"

// After: force private isolation and avoid passing raw shell commands
buildah run --isolation oci image -- /usr/bin/safe-entrypoint "$TENANT_ARG"

Detection & Verification

Check versions:

beta9-worker --version
docker image inspect TODO_VENDOR/worker:0.1.756 --format '{{.RepoTags}}'
kubectl get pods -l app=beta9-worker -o wide

Look for the vulnerable isolation settings:

grep -R "BUILDAH_ISOLATION=chroot" /etc /opt /app 2>/dev/null
grep -R "buildah .*run" /etc /opt /app 2>/dev/null

Verify the fix on a worker pod:

kubectl exec -it deploy/beta9-worker -- sh -lc 'echo $BUILDAH_ISOLATION'
kubectl exec -it deploy/beta9-worker -- sh -lc 'ps -o pid,ppid,comm -p 1'
kubectl exec -it deploy/beta9-worker -- sh -lc 'test -e /proc/1/root/bin/runc && echo "shared root visible" || echo "not visible"'

Confirm the patch behavior: build steps should use private namespaces and should not expose worker binaries or host-mounted paths through /proc/1/root. If you can still see the worker’s runc or service account token from a tenant build context, treat the deployment as still vulnerable.

Risk and Impact

This issue can let a tenant build command access the worker container’s filesystem, including binaries, mounted directories, and the Kubernetes service account token. Because worker pods are privileged, the blast radius may extend beyond a single build job to other tenant builds, registry credentials, and potentially host-adjacent resources mounted into the pod.

Even without confirmed exploitation in the wild, the combination of critical severity, default build path exposure, and low-friction trigger makes this a high-priority patch for any team running Beta9 layered builds.

Keep reading