{"id":"CVE-2026-73802","aliases":["EUVD-2026-101107","GHSA-x4q3-gcj3-m6cf","GO-2026-6656"],"status":"published","title":"Gitea Runner host isolation bypass through container options","description":"Gitea Runner passes workflow-controlled container options into Docker job container configuration while privileged mode is disabled. Host namespace settings, expanded capabilities, and security profile overrides can remain effective despite Privileged being forced false. A workflow author able to run jobs on an affected Docker-backed runner can use these options to access host namespaces and execute commands as root on the runner host, bypassing the intended container isolation.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-11","score":0.00545,"percentile":0.46204,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-269"],"published":"2026-10-02T23:18:12Z","modified":"2026-10-18T14:16:55Z","exploits":[{"source":"pocgithub","id":"sn0x-sharma/Gitea2shell-Sandbox-Escape-to-Host-RCE","title":"sn0x-sharma/Gitea2shell-Sandbox-Escape-to-Host-RCE","date":"2026-11-09","url":"https://github.com/sn0x-sharma/Gitea2shell-Sandbox-Escape-to-Host-RCE"}],"fixes":[{"ecosystem":"Go","package":"gitea.com/gitea/runner","fixed_in":["1.0.9-0.20260731160927-34bfa1915022"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"gitea.com/gitea/runner","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.9-0.20260731160927-34bfa1915022"}]}]},{"source":"osv","ecosystem":"Go","package":"gitea.com/gitea/runner","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.0.9-0.20260731160927-34bfa1915022"}]}]},{"source":"osv","ecosystem":"Go","package":"gitea.com/gitea/runner","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.0.9-0.20260731160927-34bfa1915022"}]}]}],"products":[{"vendor":"gitea","product":"gitea runner"}],"references":[{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-x4q3-gcj3-m6cf","tags":["vendor-advisory","web","advisory"]},{"url":"https://blog.gitea.com/release-of-runner-3.0.0/","tags":["release-notes"]},{"url":"https://gitea.com/gitea/runner/releases/tag/v3.0.0","tags":["release-notes","web"]},{"url":"https://gitea.com/gitea/runner/pulls/1058","tags":["web"]},{"url":"https://github.com/advisories/GHSA-x4q3-gcj3-m6cf"},{"url":"https://github.com/go-gitea/gitea","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-73802","title":"Gitea Runner host isolation bypass through container options","description":"Gitea Runner passes workflow-controlled container options into Docker job container configuration while privileged mode is disabled. Host namespace settings, expanded capabilities, and security profile overrides can remain effective despite Privileged being forced false. A workflow author able to run jobs on an affected Docker-backed runner can use these options to access host namespaces and execute commands as root on the runner host, bypassing the intended container isolation.","status":"published","published":"2026-10-14T14:37:55.141Z","modified":"2026-10-18T13:34:49.826Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-269"],"updated_at":"2026-11-02T13:43:33.766176Z"}],"euvd":[{"id":"EUVD-2026-101107","description":"Gitea Runner passes workflow-controlled container options into Docker job container configuration while privileged mode is disabled. Host namespace settings, expanded capabilities, and security profile overrides can remain effective despite Privileged being forced false. A workflow author able to run jobs on an affected Docker-backed runner can use these options to access host namespaces and execute commands as root on the runner host, bypassing the intended container isolation.","status":"published","published":"2026-10-14T14:37:55Z","modified":"2026-10-18T13:34:49Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T17:00:00.51681Z"}],"ghsa":[{"id":"GHSA-x4q3-gcj3-m6cf","title":"gitea-runner: workflow container.options passes host namespaces and capability flags to job container when privileged mode is disabled","description":"### Summary\nact_runner appends workflow-controlled `jobs.\u003cjob\u003e.container.options` directly \nto the Docker HostConfig for the job container. When runner privileged mode is \ndisabled, only `Privileged` is forced false. Host namespace flags, capability \nexpansion, and security profile overrides from workflow YAML are preserved in \nthe final HostConfig. A workflow author can enter host PID/IPC namespaces and \nexecute commands on the runner host as root.\n\n### Details\nSource-to-sink path in act_runner:\n\n- `ContainerSpec.Options` accepts workflow YAML `container.options`\n- `RunContext.options()` appends workflow options to runner-level container options\n- Job container is created with `Privileged: rc.Config.Privileged` but also \n  with `Options: rc.options(ctx)`\n- `mergeContainerConfigs()` parses Docker CLI-style options into HostConfig\n- When privileged mode is disabled, only `copts.privileged` is forced false\n- `sanitizeConfig()` only filters `Binds` and `Mounts`\n- Preserved dangerous HostConfig fields:\n\n```text\nPrivileged=false\nPidMode=host\nIpcMode=host\nCapAdd=[\"ALL\"]\nSecurityOpt=[\"seccomp=unconfined\",\"apparmor=unconfined\"]\n```\n\nAttacker workflow YAML:\n```yaml\njobs:\n  breakout:\n    runs-on: ubuntu-latest\n    container:\n      image: ubuntu:22.04\n      options: \u003e-\n        --pid=host --ipc=host --cap-add=ALL \n        --security-opt seccomp=unconfined \n        --security-opt apparmor=unconfined\n    steps:\n      - name: host namespace marker\n        run: |\n          nsenter -t 1 -m -u -i -n -p -- sh -c \"id \u003e /tmp/marker\"\n```\n\n### Impact\nAn attacker who can submit a workflow to a repository using a shared \nDocker-backed act_runner can:\n\n- Enter host PID, IPC, and mount namespaces\n- Execute arbitrary commands as root on the runner host\n- Access runner host secrets, deployment credentials, and environment variables\n- Pivot to adjacent jobs running on the same runner\n- Access internal build infrastructure reachable from the runner host\n\nCritical severity for shared runners where untrusted users can trigger \nworkflows. High severity for single-tenant runners with privileged mode \nexplicitly disabled as a security control.\n\n### Fix Direction\nTreat `container.options` as untrusted input. Reject or strip when \nprivileged mode is disabled:\n\n- Host namespaces: `--pid=host`, `--ipc=host`, `--uts=host`, `--network=host`\n- Capability expansion: `--cap-add ALL`, `--cap-add SYS_ADMIN`\n- Security overrides: `--security-opt seccomp=unconfined`, `--security-opt apparmor=unconfined`\n- Device access: `--device`, `--device-cgroup-rule`\n- Volume inheritance: `--volumes-from`\n- Runtime controls: `--runtime`, `--cgroup-parent`","status":"published","published":"2026-10-02T23:18:12Z","modified":"2026-10-02T23:18:13Z","cvss":[{"version":"3.1","score":9.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-269"],"updated_at":"2026-11-02T14:41:25.889593Z"}],"nvd":[{"id":"CVE-2026-73802","description":"Gitea Runner passes workflow-controlled container options into Docker job container configuration while privileged mode is disabled. Host namespace settings, expanded capabilities, and security profile overrides can remain effective despite Privileged being forced false. A workflow author able to run jobs on an affected Docker-backed runner can use these options to access host namespaces and execute commands as root on the runner host, bypassing the intended container isolation.","status":"published","published":"2026-10-14T15:17:24.67Z","modified":"2026-10-18T14:16:55.83Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-269"],"updated_at":"2026-11-02T14:12:58.99337Z"}],"osv":[{"id":"GHSA-x4q3-gcj3-m6cf","title":"gitea-runner: workflow container.options passes host namespaces and capability flags to job container when privileged mode is disabled","description":"### Summary\nact_runner appends workflow-controlled `jobs.\u003cjob\u003e.container.options` directly \nto the Docker HostConfig for the job container. When runner privileged mode is \ndisabled, only `Privileged` is forced false. Host namespace flags, capability \nexpansion, and security profile overrides from workflow YAML are preserved in \nthe final HostConfig. A workflow author can enter host PID/IPC namespaces and \nexecute commands on the runner host as root.\n\n### Details\nSource-to-sink path in act_runner:\n\n- `ContainerSpec.Options` accepts workflow YAML `container.options`\n- `RunContext.options()` appends workflow options to runner-level container options\n- Job container is created with `Privileged: rc.Config.Privileged` but also \n  with `Options: rc.options(ctx)`\n- `mergeContainerConfigs()` parses Docker CLI-style options into HostConfig\n- When privileged mode is disabled, only `copts.privileged` is forced false\n- `sanitizeConfig()` only filters `Binds` and `Mounts`\n- Preserved dangerous HostConfig fields:\n\n```text\nPrivileged=false\nPidMode=host\nIpcMode=host\nCapAdd=[\"ALL\"]\nSecurityOpt=[\"seccomp=unconfined\",\"apparmor=unconfined\"]\n```\n\nAttacker workflow YAML:\n```yaml\njobs:\n  breakout:\n    runs-on: ubuntu-latest\n    container:\n      image: ubuntu:22.04\n      options: \u003e-\n        --pid=host --ipc=host --cap-add=ALL \n        --security-opt seccomp=unconfined \n        --security-opt apparmor=unconfined\n    steps:\n      - name: host namespace marker\n        run: |\n          nsenter -t 1 -m -u -i -n -p -- sh -c \"id \u003e /tmp/marker\"\n```\n\n### Impact\nAn attacker who can submit a workflow to a repository using a shared \nDocker-backed act_runner can:\n\n- Enter host PID, IPC, and mount namespaces\n- Execute arbitrary commands as root on the runner host\n- Access runner host secrets, deployment credentials, and environment variables\n- Pivot to adjacent jobs running on the same runner\n- Access internal build infrastructure reachable from the runner host\n\nCritical severity for shared runners where untrusted users can trigger \nworkflows. High severity for single-tenant runners with privileged mode \nexplicitly disabled as a security control.\n\n### Fix Direction\nTreat `container.options` as untrusted input. Reject or strip when \nprivileged mode is disabled:\n\n- Host namespaces: `--pid=host`, `--ipc=host`, `--uts=host`, `--network=host`\n- Capability expansion: `--cap-add ALL`, `--cap-add SYS_ADMIN`\n- Security overrides: `--security-opt seccomp=unconfined`, `--security-opt apparmor=unconfined`\n- Device access: `--device`, `--device-cgroup-rule`\n- Volume inheritance: `--volumes-from`\n- Runtime controls: `--runtime`, `--cgroup-parent`","status":"published","published":"2026-10-02T23:18:12Z","modified":"2026-10-07T17:55:44.795358931Z","cvss":[{"version":"3.1","score":9.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-269"],"updated_at":"2026-11-02T15:46:59.484835Z"},{"id":"GO-2026-6656","title":"gitea-runner: workflow container.options passes host namespaces and capability flags to job container when privileged mode is disabled in gitea.com/gitea/runner","description":"gitea-runner: workflow container.options passes host namespaces and capability flags to job container when privileged mode is disabled in gitea.com/gitea/runner","status":"published","published":"2026-10-07T14:10:14Z","modified":"2026-10-07T17:45:12.474497003Z","updated_at":"2026-11-02T15:47:03.11707Z"}]}}