Live › vulnerability › CVE-2026-73802
Go to dashboardGitea Runner passes workflow-defined container options into Docker job containers even when privileged mode is disabled, so host namespaces, extra capabilities, and security profile overrides still apply. A workflow author on an affected Docker-backed runner can use these options to get root command execution on the runner host.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:13 UTC, 0h before NVD. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| gitea.com/gitea/runner | go | < 1.0.9-0.20260731160927-34bfa1915022 | 1.0.9-0.20260731160927-34bfa1915022 |
Check the gitea.com/gitea/runner version in use and compare it to the fixed pseudo-version 1.0.9-0.20260731160927-34bfa1915022; anything older is affected.
Upgrade gitea.com/gitea/runner to 1.0.9-0.20260731160927-34bfa1915022 or later.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Gitea Runner passes workflow-controlled container options into Docker job container configuration while privileged mode is disabled. Host namespace settings, expanded capabilities, and security profile overrides can remain effective despite Privileged being forced false. A workflow author able to run jobs on an affected Docker-backed runner can use these options to access host namespaces and execute commands as root on the runner host, bypassing the intended container isolation.
This page as .md · .json · in your agent: get_signal("CVE-2026-73802")
Go Vulnerability Database, CC-BY 4.0 · EPSS scores by FIRST, used with attribution · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.