CVE-2026-73802
gitea-runner: workflow container.options passes host namespaces and capability flags to job container when privileged mode is disabled
act_runner appends workflow-controlled jobs.<job>.container.options directly to the Docker HostConfig for the job container. When runner privileged mode is disabled, only Privileged is forced false. Host namespace flags, capability expansion, and security profile overrides from workflow YAML are preserved in the final HostConfig.
- No known exploitation
- Severity
- Critical, CVSS 9.9 (v3.1)
- EPSS
- 0.47% chance of exploitation in 30 days (EPSS, as of Oct 23, 2026)
- Affected packages
- gitea.com/gitea/runner (go) < 1.0.9-0.20260731160927-34bfa1915022, fixed in 1.0.9-0.20260731160927-34bfa1915022 · GHSA-x4q3-gcj3-m6cf