# CVE-2026-120306: Beta9 worker container escape via Buildah namespace isolation bypass

Source: https://junglewise.ai/threats/cve-2026-120306-beta9-turns-each-shell-command-in-a-tenant-image-definition-into  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-01. Updated: 2026-11-01  
License: CC BY 4.0 with a link back

CVE-2026-120306 · Severity: critical · CVSS 9.9 · Published 2026-11-01

Beta9 is a serverless GPU compute platform that executes tenant container builds on shared worker pods. An attacker can escape the container build isolation and access the host worker environment, including Kubernetes credentials, container runtimes, and other tenants' data. This allows full compromise of the worker node and lateral movement within the cluster.

Technologies: [Beam Cloud Beta9 Worker](https://junglewise.ai/threats/technologies/beta9-worker). Vendors: [Beam Cloud](https://junglewise.ai/threats/vendors/beam-cloud).

## Quick answers

**Is CVE-2026-120306 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-120306 being exploited in the wild.

**How severe is CVE-2026-120306?** Critical severity, with a CVSS score of 9.9, published 1 November 2026.

**Which products and versions are affected?** Beam Cloud Beta9 Worker before 0.1.756.

**Is there a fix for CVE-2026-120306?** Yes: fixed in Worker 0.1.756. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-120306 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-120306?** Check whether you run Beam Cloud Beta9 Worker at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in Worker 0.1.756

## Technical details

The vulnerability exists in Beta9's Buildah-based container image build process, which runs RUN steps with only filesystem isolation (chroot) but shares PID, network, IPC, and user namespaces with the worker pod. Build processes run as uid 0 with CAP_DAC_OVERRIDE, can access /proc/1/root (the worker filesystem), and reach container runtimes and service account tokens. A tenant submitting a malicious image definition via Clip v2 layered builds can read and manipulate the worker pod's resources. The fix in worker 0.1.756 enforces OCI isolation with private PID, IPC, and network namespaces for build steps.

## Affected products

- Beam Cloud Beta9 Worker before 0.1.756

## Timeline

- 2026-11-01: disclosed

## References

- [https://github.com/beam-cloud/beta9/releases](https://github.com/beam-cloud/beta9/releases)
- [https://github.com/beam-cloud/beta9](https://github.com/beam-cloud/beta9)

## Related threats

- [Beta9 path traversal in volume attachment](https://junglewise.ai/threats/cve-2026-120308-a-beta9-tenant-can-attach-a-volume-when-deploying-a-function)
- [Beta9 worker path traversal in sandbox file API](https://junglewise.ai/threats/cve-2026-120307-the-beta9-worker-serves-the-sandbox-file-api-from-outside-the)