8.8
High
CVE-2026-73802 Gitea Runner passes workflow-controlled container options into Docker job container configuration while privileged…
Description
Gitea Runner passes workflow-controlled container options into Docker job container configuration while privileged mode is disabled. Host namespace settings, expanded capabilities, and security profile overrides can remain effective despite Privileged being forced false. A workflow author able to run jobs on an affected Docker-backed runner can use these options to access host namespaces and execute commands as root on the runner host, bypassing the intended container isolation.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Gitea Runner 3.0 | earliest → < 3.0.0 | 3.0.0 |
References
- GitHub Security Advisory GHSA-x4q3-gcj3-m6cf github.com
- Gitea Runner 3.0.0 release announcement blog.gitea.com
- gitea/runner v3.0.0 release gitea.com
Timeline
- Published
- Last modified