CVE-2026-73802: 
Gitea vulnerability analysis and mitigation

CVE-2026-73802 is a critical container escape vulnerability in Gitea's act_runner component, titled "gitea-runner: workflow container.options passes host namespaces and capability flags to job container when privileged mode is disabled." It affects gitea.com/gitea/runner versions prior to 1.0.9-0.20260731160927-34bfa1915022 (or equivalently, prior to v3.0.0). The vulnerability was first published on August 15, 2026, and added to the GitHub Advisory Database on October 2, 2026. It carries a CVSS v3.1 base score of 9.9 (Critical) (GitHub Advisory, Gitea Security Advisory).

The root cause is improper privilege management (CWE-269): act_runner passes workflow-controlled jobs.<job>.container.options directly into the Docker HostConfig for the job container without adequate sanitization. The data flow is: ContainerSpec.Options accepts workflow YAML container.options → RunContext.options() appends these to runner-level options → mergeContainerConfigs() parses Docker CLI-style flags into HostConfig → sanitizeConfig() only strips Binds and Mounts, leaving dangerous fields intact. When privileged mode is disabled, only copts.privileged is forced to false; host namespace flags (--pid=host, --ipc=host), capability expansions (--cap-add=ALL), and security profile overrides (--security-opt seccomp=unconfined, --security-opt apparmor=unconfined) are all preserved in the final HostConfig. An attacker with workflow submission rights can craft a YAML payload using nsenter to execute commands in the host's PID/IPC/mount namespaces as root (GitHub Advisory, Gitea Security Advisory).

A successful exploit allows a workflow author to fully escape the job container and execute arbitrary commands as root on the runner host, even when privileged mode is explicitly disabled as a security control. The attacker can access runner host secrets, deployment credentials, and environment variables; pivot to adjacent jobs running on the same shared runner; and reach internal build infrastructure accessible from the runner host. The impact is rated Critical for shared runners where untrusted users can trigger workflows, and High for single-tenant runners where privileged mode was relied upon as a security boundary (GitHub Advisory, Gitea Security Advisory).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported as of the available data (exploitedAt and proofOfConcepts fields are empty in threat intelligence). The CVE status remains "Reserved" in the NVD. The vulnerability requires only low privileges (the ability to submit a workflow to a repository) and no user interaction, making it straightforward to exploit once access is obtained. It is detectable by Qualys scanners (detection ID 5019205) and is not currently listed in the CISA KEV catalog (GitHub Advisory, Feedly).

1. Reconnaissance: Identify a Gitea instance using a shared Docker-backed act_runner with version < 3.0.0 where untrusted users can submit or trigger workflows.
2. Craft malicious workflow YAML: Create a workflow file with a job that specifies a container with dangerous options:

jobs:
  breakout:
    runs-on: ubuntu-latest
    container:
      image: ubuntu:22.04
      options: >-
        --pid=host --ipc=host --cap-add=ALL
        --security-opt seccomp=unconfined
        --security-opt apparmor=unconfined
    steps:
      - name: host namespace marker
        run: |
          nsenter -t 1 -m -u -i -n -p -- sh -c "id > /tmp/marker"

3. Submit the workflow: Push the workflow file to a repository monitored by the vulnerable runner, or trigger it via a pull request or manual dispatch.
4. Container escape via nsenter: When the runner executes the job, the container is created with PidMode=host, IpcMode=host, and CapAdd=["ALL"] despite Privileged=false. The nsenter command enters the host's namespaces (PID 1 = host init process).
5. Execute as root on host: Commands run inside nsenter execute in the host's mount, UTS, IPC, network, and PID namespaces as root, enabling arbitrary command execution, credential theft, or lateral movement to internal infrastructure (GitHub Advisory, Gitea Security Advisory).

• Workflow/CI Logs: Job container created with options containing --pid=host, --ipc=host, --cap-add=ALL, --security-opt seccomp=unconfined, or --security-opt apparmor=unconfined in runner logs.
• Docker/Container: Docker daemon logs showing container creation with PidMode: host, IpcMode: host, or CapAdd: [ALL] for a non-privileged job container.
• Process: Unexpected nsenter process spawned from within a CI job container; child processes of the runner's Docker container appearing in the host's process tree (e.g., sh, bash, curl, wget) with host-level namespace context.
• File System: Unexpected files written to host paths (e.g., /tmp/marker) by processes originating from a CI container; new cron jobs, SSH keys, or scripts added to the runner host by the runner service account.
• Network: Outbound connections from the runner host to unexpected external IPs or internal infrastructure initiated during a CI job execution.
• Logs: Runner host audit logs (auditd) showing nsenter or namespace-switching syscalls (setns, unshare) originating from a containerized process (GitHub Advisory).

The fix is available in gitea.com/gitea/runner version 1.0.9-0.20260731160927-34bfa1915022 and the tagged release v3.0.0. Operators should upgrade to v3.0.0 or later immediately. The fix treats container.options as untrusted input and rejects or strips dangerous flags when privileged mode is disabled, including host namespace flags (--pid=host, --ipc=host, --uts=host, --network=host), capability expansions (--cap-add ALL, --cap-add SYS_ADMIN), security overrides (--security-opt seccomp=unconfined, --security-opt apparmor=unconfined), device access (--device), volume inheritance (--volumes-from), and runtime controls (--runtime, --cgroup-parent). As a short-term workaround prior to patching, restrict workflow submission to trusted users only and avoid using shared runners for repositories with untrusted contributors (GitHub Advisory, Gitea Security Advisory).