CVE-2026-73802

Gitea Runner passes workflow-controlled container options into Docker job container configuration while privileged mode is disabled. Host namespace settings, expanded capabilities, and security profile overrides can remain effective despite Privileged being forced false. A workflow author able to...

CVE-2026-73802

The Gitea Runner (specifically the act_runner component) is vulnerable to a host isolation bypass because it appends workflow-controlled jobs..container.options directly to the Docker HostConfig . Although the runner may force Privileged to false, it fails to sanitize other dangerous fields like ...

GO-2026-6656 gitea-runner: workflow container.options passes host namespaces and capability flags to job container when privileged mode is disabled in gitea.com/gitea/runner

gitea-runner: workflow container.options passes host namespaces and capability flags to job container when privileged mode is disabled in gitea.com/gitea/runner...

gitea-runner: workflow container.options passes host namespaces and capability flags to job container when privileged mode is disabled

Summary actrunner appends workflow-controlled jobs..container.options directly to the Docker HostConfig for the job container. When runner privileged mode is disabled, only Privileged is forced false. Host namespace flags, capability expansion, and security profile overrides from workflow YAML ar...

GHSA-X4Q3-GCJ3-M6CF gitea-runner: workflow container.options passes host namespaces and capability flags to job container when privileged mode is disabled

Summary actrunner appends workflow-controlled jobs..container.options directly to the Docker HostConfig for the job container. When runner privileged mode is disabled, only Privileged is forced false. Host namespace flags, capability expansion, and security profile overrides from workflow YAML ar...

gitea-runner: workflow container.options passes host namespaces and capability flags to job container when privileged mode is disabled

actrunner appends workflow-controlled jobs..container.options directly to the Docker HostConfig for the job container. When runner privileged mode is disabled, only Privileged is forced false. Host namespace flags, capability expansion, and security profile overrides from workflow YAML are...