Answer in brief
CVE-2026-73802 records a Critical severity (CVSS 9.9) vulnerability in gitea-runner: workflow container.options passes host namespaces and capability flags to job container when privileged mode is disabled. The current sources do not mark it as known exploited. The current feed maps gitea.com/gitea/runner (go). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 9.9. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps gitea.com/gitea/runner (go). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| gitea.com/gitea/runnergo | <1.0.9-0.20260731160927-34bfa1915022 | 1.0.9-0.20260731160927-34bfa1915022 |
Published upstream
Oct 2, 2026
Evidence: source:ghsa:source_dates:source-dates:recordSource modified
Oct 2, 2026
Evidence: source:ghsa:source_dates:source-dates:recordFirst seen by HOL
Oct 2, 2026
### Summary act_runner appends workflow-controlled `jobs.<job>.container.options` directly to the Docker HostConfig for the job container. When runner privileged mode is disabled, only `Privileged` is forced false. Host namespace flags, capability expansion, and security profile overrides from workflow YAML are preserved in the final HostConfig. A workflow author can enter host PID/IPC namespaces and execute commands on the runner host as root. ### Details Source-to-sink path in act_runner: - `ContainerSpec.Options` accepts workflow YAML `container.options` - `RunContext.options()` appends workflow options to runner-level container options - Job container is created with `Privileged: rc.Config.Privileged` but also with `Options: rc.options(ctx)` - `mergeContainerConfigs()` parses Docker CLI-style options into HostConfig - When privileged mode is disabled, only `copts.privileged` is forced false - `sanitizeConfig()` only filters `Binds` and `Mounts` - Preserved dangerous HostConfig fields: ```text Privileged=false PidMode=host IpcMode=host CapAdd=["ALL"] SecurityOpt=["seccomp=unconfined","apparmor=unconfined"] ``` Attacker workflow YAML: ```yaml jobs: breakout: runs-on: ubuntu-latest container: image: ubuntu:22.04 options: >- --pid=host --ipc=host --cap-add=ALL --security-opt seccomp=unconfined --security-opt apparmor=unconfined steps: - name: host namespace marker run: | nsenter -t 1 -m -u -i -n -p -- sh -c "id > /tmp/marker" ``` ### Impact An attacker who can submit a workflow to a repository using a shared Docker-backed act_runner can: - Enter host PID, IPC, and mount namespaces - Execute arbitrary commands as root on the runner host - Access runner host secrets, deployment credentials, and environment variables - Pivot to adjacent jobs running on the same runner - Access internal build infrastructure reachable from the runner host Critical severity for shared runners where untrusted users can trigger workflows. High severity for single-tenant runners with privileged mode explicitly disabled as a security control. ### Fix Direction Treat `container.options` as untrusted input. Reject or strip when privileged mode is disabled: - Host namespaces: `--pid=host`, `--ipc=host`, `--uts=host`, `--network=host` - Capability expansion: `--cap-add ALL`, `--cap-add SYS_ADMIN` - Security overrides: `--security-opt seccomp=unconfined`, `--security-opt apparmor=unconfined` - Device access: `--device`, `--device-cgroup-rule` - Volume inheritance: `--volumes-from` - Runtime controls: `--runtime`, `--cgroup-parent`
Quoted source text, attributed separately from HOL analysis.