Vulnerability · Published Oct 14, 2026 · Assigned by Gitea
CVE-2026-73802Gitea Runner host isolation bypass through container options
High 8.8
In plain English
A high-severity privilege mismanagement in Gitea Runner from Gitea. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 46% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Gitea Runner passes workflow-controlled container options into Docker job container configuration while privileged mode is disabled. Host namespace settings, expanded capabilities, and security profile overrides can remain effective despite Privileged being forced false. A workflow author able to run jobs on an affected Docker-backed runner can use these options to access host namespaces and execute commands as root on the runner host, bypassing the intended container isolation.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | gitea.com/gitea/runner | 1.0.9-0.20260731160927-34bfa1915022 | GHSA-x4q3-gcj3-m6cf |
| Go | gitea.com/gitea/runner | 1.0.9-0.20260731160927-34bfa1915022 | GO-2026-6656 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Gitea | Gitea Runner | 0 – before 3.0.0 |
Weakness: CWE-269 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- GitHub Security Advisory GHSA-x4q3-gcj3-m6cf vendor-advisory
- Gitea Runner 3.0.0 release announcement release-notes
- gitea/runner v3.0.0 release release-notes