What’s Vulnerable › Vulnerabilities

CVE-2026-73802: Gitea Runner host isolation bypass through container options

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-14 · updated 2026-10-18
• Weakness: CWE-269

Description

Gitea Runner passes workflow-controlled container options into Docker job container configuration while privileged mode is disabled. Host namespace settings, expanded capabilities, and security profile overrides can remain effective despite Privileged being forced false. A workflow author able to run jobs on an affected Docker-backed runner can use these options to access host namespaces and execute commands as root on the runner host, bypassing the intended container isolation.

Affected products

• Gitea Runner: before 3.0.0 — fixed in 3.0.0

How to fix

Upgrade to a fixed version: Gitea Runner 3.0.0. Check the vendor advisory for mitigations.

References

• https://blog.gitea.com/release-of-runner-3.0.0/
• https://gitea.com/gitea/runner/releases/tag/v3.0.0
• https://github.com/go-gitea/gitea/security/advisories/GHSA-x4q3-gcj3-m6cf

Get alerted when CVE-2026-73802 or the next vulnerability affects your stack