Beta9 is vulnerable to Host Filesystem Exposure via Volume Path Traversal

A tenant who deploys a function, endpoint, or task queue on Beta9 can attach a volume. ConfigureContainerRequestMounts in pkg/abstractions/common/mount.go builds the host path by joining the shared volumes root, the workspace name, and the volume identifier from the stub. Nothing checks that the identifier names a volume that workspace owns. Parent-directory segments in the identifier collapse the joined path to the worker's filesystem root. The worker bind-mounts that path into the sandbox. The mount is read-write unless the volume was explicitly marked read-only, which is not the default.

A workspace token is enough. On gateway 0.1.769 and worker 0.1.745, a volume identifier made of parent-directory segments made the container mount show the worker root: the worker hostname and resolver configuration were readable from inside the sandbox, and the directory listing contained host directories rather than an empty tenant volume. Other tenants' volumes stored on that host are on the same filesystem. The proof read those files. It was not run against a live multi-tenant cluster.

Gateway 0.1.776 and worker 0.1.756 reject an identifier that is empty, . , .. , or contains a slash, and a mount path that contains a .. segment. The gateway also refuses a volume the workspace does not own. Stubs saved before the check existed are validated when they are launched, so both components need the upgrade.

Step 1 - Install the client and select the deployment

Step 2 - Save the volume deploy

The subclass marks the volume ready so the client sends the identifier as given, instead of looking up a real volume first. The function then reads two files through the resulting mount and lists the mount root.

Step 3 - Deploy and run it

Expected output on gateway 0.1.769 with worker 0.1.745. /pwn is the worker root, so the listing contains host directories such as /data , /root , and /run , and the hostname file is the worker's:

On gateway 0.1.776 or later, together with worker 0.1.756 or later, stub creation rejects the identifier and the function does not start.

Vulnerability Mitigations

Upgrade the gateway to 0.1.776 or later and the worker to 0.1.756 or later. Volume identifiers and mount paths are validated before a mount is built, and the gateway rejects a volume that does not exist or is not owned by the workspace. Upgrade both. A stub saved by an old gateway is checked again when a new worker launches it, and an old worker still mounts the path an old gateway sends.

The change is , commit a28bf12cf0007c792a25d8ed282b4e8bf6f30393, released on 2026-09-15.