{"id":"CVE-2026-73802","title":"Gitea Runner passes workflow-controlled container options into Docker job container configuration while privileged mode is disabled","summary":"Gitea Runner passes workflow-controlled container options into Docker job container configuration while privileged mode is disabled. Host namespace settings, expanded capabilities, and security profile overrides can remain effective desp…","severity":"critical","cvss":9.9,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cwe":["CWE-269"],"vendor":"gitea","product":"gitea.com/gitea/runner","affected":["gitea.com/gitea/runner < 1.0.9-0.20260731160927-34bfa1915022"],"patched":["gitea.com/gitea/runner 1.0.9-0.20260731160927-34bfa1915022"],"published":"2026-10-14","updated":"2026-10-14","sourceUpdated":"2026-10-14T16:04:39.483","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-73802","references":[{"url":"https://blog.gitea.com/release-of-runner-3.0.0/","label":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://gitea.com/gitea/runner/releases/tag/v3.0.0","label":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-x4q3-gcj3-m6cf","label":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://gitea.com/gitea/runner/pulls/1058"},{"url":"https://github.com/go-gitea/gitea"},{"url":"https://github.com/advisories/GHSA-x4q3-gcj3-m6cf"}],"tags":["nvd","osv","go","ghsa","cve.org"],"aliases":["GHSA-x4q3-gcj3-m6cf","GO-2026-6656"],"ecosystem":"go","cvssSource":"osv","ingestedAt":"2026-10-02T23:34:57.388Z","epss":0.00472,"epssPercentile":0.40659,"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-10-18T13:34:45.738812Z"},"scores":{"osv":9.9,"adp":8.8},"slug":"CVE-2026-73802","body":"## Overview\n\nGitea Runner passes workflow-controlled container options into Docker job container configuration while privileged mode is disabled. Host namespace settings, expanded capabilities, and security profile overrides can remain effective despite Privileged being forced false. A workflow author able to run jobs on an affected Docker-backed runner can use these options to access host namespaces and execute commands as root on the runner host, bypassing the intended container isolation.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-73802)\n\nAffected packages:\n\n- `gitea.com/gitea/runner < 1.0.9-0.20260731160927-34bfa1915022`\n\nPatched in:\n\n- `gitea.com/gitea/runner 1.0.9-0.20260731160927-34bfa1915022`\n\nSource: https://osv.dev/vulnerability/GHSA-x4q3-gcj3-m6cf","depth":"midnight","depthScore":55,"depthScoreParts":{"impact":54.5,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}