GO-2026-6656 gitea-runner: workflow container.options passes host namespaces and capability flags to job container when privileged mode is disabled in gitea.com/gitea/runner

gitea-runner: workflow container.options passes host namespaces and capability flags to job container when privileged mode is disabled in gitea.com/gitea/runner...

gitea-runner: workflow container.options passes host namespaces and capability flags to job container when privileged mode is disabled

Summary actrunner appends workflow-controlled jobs..container.options directly to the Docker HostConfig for the job container. When runner privileged mode is disabled, only Privileged is forced false. Host namespace flags, capability expansion, and security profile overrides from workflow YAML ar...

gitea-runner: workflow container.options passes host namespaces and capability flags to job container when privileged mode is disabled

actrunner appends workflow-controlled jobs..container.options directly to the Docker HostConfig for the job container. When runner privileged mode is disabled, only Privileged is forced false. Host namespace flags, capability expansion, and security profile overrides from workflow YAML are...

PT-2026-104588

Name of the Vulnerable Software and Affected Versions act runner affected versions not specified Description The act runner appends workflow-controlled jobs..container.options directly to the Docker HostConfig for the job container. When privileged mode is disabled, the system only forces the...

CVE-2026-58053

Gitea actrunner with the Docker backend through act 0.262.0 passes a workflow's container.options string to the Docker job container's HostConfig and, when configured with privileged: false, forces only the Privileged flag off while merging options such as --pid=host, --cap-add, and --security-op...

CVE-2026-58053: Improper Privilege Management

Gitea actrunner with the Docker backend through act 0.262.0 passes a workflow's container.options string to the Docker job container's HostConfig and, when configured with privileged: false, forces only the Privileged flag off while merging options such as --pid=host, --cap-add, and --security-op...