CVE-2026-73802

Gitea Runner passes workflow-controlled container options into Docker job container configuration while privileged mode is disabled. Host namespace settings, expanded capabilities, and security profile overrides can remain effective despite Privileged being forced false. A workflow author able to...

gitea-runner: workflow container.options passes host namespaces and capability flags to job container when privileged mode is disabled

actrunner appends workflow-controlled jobs..container.options directly to the Docker HostConfig for the job container. When runner privileged mode is disabled, only Privileged is forced false. Host namespace flags, capability expansion, and security profile overrides from workflow YAML are...