CVE-2026-73802

Deferred Deferred - Pending Action

Privilege Escalation in Gitea Runner via Docker Container Options

Publication date: 2026-10-14

Last updated on: 2026-10-18

Assigner: Gitea Limited

Description

Gitea Runner passes workflow-controlled container options into Docker job container configuration while privileged mode is disabled. Host namespace settings, expanded capabilities, and security profile overrides can remain effective despite Privileged being forced false. A workflow author able to run jobs on an affected Docker-backed runner can use these options to access host namespaces and execute commands as root on the runner host, bypassing the intended container isolation.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-18

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-73802

EUVD

EUVD-2026-101107

Affected Vendors & Products

Vendor	Product	Version / Range
Gitea	Gitea	Runner 0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-269	The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

Executive Summary

This is a container-escape vulnerability in Gitea Runner where workflow-controlled container options are passed into Docker job containers even when privileged mode is disabled. This allows host namespace access, expanded capabilities, and security profile overrides to remain effective, bypassing intended container isolation. An attacker with workflow submission rights can exploit this to access host namespaces and execute commands as root on the runner host.

Detection Guidance

Check if your Gitea Runner version is below 3.0.0 by running: gitea-runner --version. Inspect workflow YAML files for dangerous container options like --pid=host, --ipc=host, --cap-add=ALL, or security overrides. Review Docker runner configurations for privileged mode settings.

Impact Analysis

If you use Gitea Runner with Docker-backed runners, an attacker who can submit workflows could gain root access to your runner host. This could allow them to access sensitive data, execute arbitrary commands, or compromise the entire host system. The impact is highest in shared runner environments where untrusted users can trigger workflows.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating compliance requirements for GDPR, HIPAA, and other regulations. Unauthorized root access on a runner host could result in data breaches, loss of data integrity, or failure to meet data protection standards.

Mitigation Strategies

Upgrade Gitea Runner to version 3.0.0 or later immediately. Disable privileged mode unless absolutely required. Review and sanitize workflow YAML files to remove dangerous container options. Restrict workflow submissions to trusted users in shared environments.

Hi! I’m here to help you understand CVE-2026-73802. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70