Directory Traversal Vulnerability in Beta9 by Beam Cloud
CVE-2026-120308

9.9CRITICAL

Key Information:

Vendor

Beam-cloud

Status
Beta9 Gateway
Beta9 Worker
Vendor
CVE Published:
1 November 2026

What is CVE-2026-120308?

A directory traversal vulnerability allows tenants within the Beta9 application to manipulate volume identifiers during function deployment. This manipulation can lead to unauthorized read and write access to files on the worker's filesystem, potentially exposing other tenants' data. Specifically, the vulnerability arises from inadequate validation of volume identifiers, which can result in the construction of invalid paths. It affects versions gateway-0.1.769 and worker-0.1.745 but has been remediated in newer versions, where validations ensure that only volumes owned by the respective workspace can be accessed, thereby safeguarding tenant data.

Affected Version(s)

Beta9 gateway 0 < 0.1.776

Beta9 worker 0 < 0.1.756

References

https://github.com/beam-cloud/beta9
product
https://github.com/beam-cloud/beta9/pull/1897
patch
https://github.com/beam-cloud/beta9/commit/a28bf12cf0007c...
patch

CVSS V3.1

Score:
9.9
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Natan Nehorai
JFrog Security Research
.