vulnerability · Fri 02 Oct 2026 · 23:18 UTC
GHSA-x4q3-gcj3-m6cf: gitea-runner: workflow container.options passes host namespaces and capability flags to job container when
Filed UTCSource GTH ↗
act_runner appends workflow-controlled jobs. .container.options directly to the Docker HostConfig for the job container. When runner privileged mode is disabled, only Privileged is forced false. Host namespace flags, capability expansion, and security profile overrides from workflow YAML are preserved in the final HostConfig. A workflow author can enter host PID/IPC namespaces and execute commands on the runner host as root. …
Signals
as the pipeline stamped them- High
- Critical vulnerability — CVSS 9.9
- What to do
- Critical severity — schedule an urgent patch.
CVE
KEV from CISA · EPSS from FIRST| Id | KEV | EPSS | Reference |
|---|---|---|---|
| CVE-2026-73802 | — | 0.20% | NVD ↗ |
Get the next one first.
Every dispatch goes to Telegram and RSS the moment it is published, and the whole wire is a keyless JSON API.
Check your stack
Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.
Stack checkNo key. No signup.