# CVE-2026-120308: Beta9 path traversal in volume attachment

Source: https://junglewise.ai/threats/cve-2026-120308-a-beta9-tenant-can-attach-a-volume-when-deploying-a-function  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-01. Updated: 2026-11-01  
License: CC BY 4.0 with a link back

CVE-2026-120308 · Severity: critical · CVSS 9.9 · Published 2026-11-01

Beta9 is a serverless GPU inference and task execution platform. An authenticated tenant can use directory traversal in volume identifiers to escape their assigned workspace and read or write arbitrary files on the worker node, including other tenants' data. This allows one customer to access another customer's volumes and worker filesystem without authorization.

Technologies: [Beam Cloud Beta9 Worker](https://junglewise.ai/threats/technologies/beta9-worker). Vendors: [Beam Cloud](https://junglewise.ai/threats/vendors/beam-cloud).

## Quick answers

**Is CVE-2026-120308 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-120308 being exploited in the wild.

**How severe is CVE-2026-120308?** Critical severity, with a CVSS score of 9.9, published 1 November 2026.

**Which products and versions are affected?** Beam Cloud Beta9 Gateway before 0.1.776; Beam Cloud Beta9 Worker before 0.1.756.

**Is there a fix for CVE-2026-120308?** Yes: fixed in Beta9 Gateway 0.1.776 and later; Beta9 Worker 0.1.756 and later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-120308 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-120308?** Check whether you run Beam Cloud Beta9 Gateway or Beam Cloud Beta9 Worker at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in Beta9 Gateway 0.1.776 and later; Beta9 Worker 0.1.756 and later

## Technical details

The gateway constructs host mount paths by joining a shared volumes root, workspace name, and untrusted volume identifier from deployment stubs without validation. An attacker with a workspace token can supply a volume identifier containing parent-directory segments (../) to collapse the path outside the workspace boundary. The worker then bind-mounts the attacker-controlled path into the sandbox read-write unless marked read-only, exposing the worker's entire filesystem and other tenants' volumes.

## Affected products

- Beam Cloud Beta9 Gateway before 0.1.776
- Beam Cloud Beta9 Worker before 0.1.756

## Timeline

- 2026-11-01: disclosed

## References

- [https://github.com/beam-cloud/beta9/releases](https://github.com/beam-cloud/beta9/releases)
- [https://github.com/beam-cloud/beta9](https://github.com/beam-cloud/beta9)

## Related threats

- [Beta9 worker path traversal in sandbox file API](https://junglewise.ai/threats/cve-2026-120307-the-beta9-worker-serves-the-sandbox-file-api-from-outside-the)
- [Beta9 worker container escape via Buildah namespace isolation bypass](https://junglewise.ai/threats/cve-2026-120306-beta9-turns-each-shell-command-in-a-tenant-image-definition-into)