Vulnerability · Published Jun 28, 2026 · Assigned by VulnCheck

CVE-2026-58053Gitea act_runner - Container Hardening Bypass via Workflow Container Options

Critical 9.9

In plain English

A critical-severity privilege mismanagement in act_runner from Gitea. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 39% of all known vulnerabilities).

Severity (CVSS 3.1)9.9Critical

Exploit odds (30 days)0.4%top 61.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Gitea act_runner with the Docker backend (through act 0.262.0) passes a workflow's container.options string to the Docker job container's HostConfig and, when configured with privileged: false, forces only the Privileged flag off while merging options such as --pid=host, --cap-add, and --security-opt unchanged. A user who can run a workflow on a Docker-backed runner can create a job container with host namespaces and broad capabilities and escape to the host as root despite privileged mode being disabled.

Affected products (as reported)

Vendor	Product	Versions
Gitea	act_runner	0 – through 0.262.0

Weakness: CWE-269 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

References

Proof of Concept exploit, third-party-advisory
VulnCheck Advisory: Gitea act_runner - Container Hardening Bypass via Workflow Container Options third-party-advisory