CVE-2026-73802 · GHSA-x4q3-gcj3-m6cf
gitea-runner: workflow container.options passes host namespaces and capability flags to job container when privileged mode is disabled
- Risk score
- 66/100
- CVSS
- 8.8 v3.1
- Exploit chance (30 days)
- 0.5%
- Published
- 2 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Gitea Runner passes workflow-controlled container options into Docker job container configuration while privileged mode is disabled. Host namespace settings, expanded capabilities, and security profile overrides can remain effective despite Privileged being forced false. A workflow author able to run jobs on an affect…
- Affected
- gitea.com/gitea/runner (go) < 1.0.9-0.20260731160927-34bfa1915022
- Fix
- Upgrade gitea.com/gitea/runner to 1.0.9-0.20260731160927-34bfa1915022 or later.
- Exploitation
- No known exploitation
Why it is Amber
- CVSS 8.8 high
- On your watchlist: Go
Affected packages
| Package | Ecosystem | Vulnerable | Fixed in |
|---|---|---|---|
| gitea.com/gitea/runner | go | < 1.0.9-0.20260731160927-34bfa1915022 | 1.0.9-0.20260731160927-34bfa1915022 |
References
- https://github.com/advisories/GHSA-x4q3-gcj3-m6cf
- https://github.com/go-gitea/gitea/security/advisories/GHSA-x4q3-gcj3-m6cf
- https://gitea.com/gitea/runner/pulls/1058
- https://gitea.com/gitea/runner/releases/tag/v3.0.0
- https://github.com/advisories/GHSA-x4q3-gcj3-m6cf
- https://blog.gitea.com/release-of-runner-3.0.0/
Original description
Gitea Runner passes workflow-controlled container options into Docker job container configuration while privileged mode is disabled. Host namespace settings, expanded capabilities, and security profile overrides can remain effective despite Privileged being forced false. A workflow author able to run jobs on an affected Docker-backed runner can use these options to access host namespaces and execute commands as root on the runner host, bypassing the intended container isolation.
Last activity 2 Oct 2026. Patch Forecast updates every hour.