Container Build Isolation Bypass via Namespace Leakage

Beta9 turns each shell command in a tenant image definition into a Dockerfile RUN line and executes it with Buildah on the build worker. The worker image sets BUILDAH_ISOLATION=chroot, and no buildah invocation passes --isolation, so the step only changes its filesystem root. It keeps the worker pod's PID, network, IPC, and user namespaces, runs as uid 0, and holds CAP_DAC_OVERRIDE. PID 1 in that procfs is the worker entrypoint, so /proc/1/root is the worker container's filesystem and is writable. That filesystem contains the runc, buildah, and runsc binaries the worker uses to start tenant containers, the worker's Kubernetes service account token, and the host directories mounted into the pod. Worker pods are privileged. Clip v2 layered builds are the default, so a tenant with a workspace token reaches this by submitting one image build. The read-only proof confirmed the shared namespaces, CAP_DAC_OVERRIDE, and that the worker's runc binary is visible at /proc/1/root. Fixed in worker

Casky was already ahead

This CVE exploits attack patterns that Casky's 224matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

Beta9's container build system uses Buildah with chroot isolation to execute shell commands from tenant image definitions, but fails to enforce proper namespace separation. By setting BUILDAH_ISOLATION=chroot without explicit --isolation flags, build workers retain shared PID, network, IPC, and user namespaces with the host container while running as root (uid 0) with CAP_DAC_OVERRIDE capabilities. This configuration allows attackers to escape the filesystem sandbox by accessing /proc/1/root, which points to the writable worker container filesystem, enabling arbitrary code execution and lateral movement across tenant boundaries. Organizations using Beta9 for multi-tenant container builds face critical risks of supply chain compromise, data exfiltration, and infrastructure takeover.

Casky's 224 mapped security skills detect the attack patterns behind this vulnerability by analyzing Privilege Escalation (TA0004) techniques through Claude's extended reasoning capabilities. Practitioners would observe findings related to improper capability management (CAP_DAW_OVERRIDE in unprivileged contexts), namespace configuration anomalies (shared PID/network namespaces where isolation should exist), and filesystem access control bypasses via /proc manipulation. The platform would flag suspicious build worker behaviors including attempts to access parent container filesystems, manipulation of namespace files, and exploitation of chroot limitations. Security teams would see correlated signals indicating container escape patterns, allowing them to identify compromised build pipelines before malicious container images propagate through their registries and into production environments.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

224 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-120306.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

identity access management · low

Run

MITRE ATT&CK Techniques

TA0004

Investigate the attack patterns behind CVE-2026-120306

Casky has 224 skills that investigate the attack patterns behind CVE-2026-120306. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn