HIGHCVSS 9.9

CVE-2026-73802

CVE-2026-73802 updated by NVD

Published: 2026-10-02
Modified: 2026-10-20
Sources: github-advisory, nvd

Summary

Gitea Runner passes workflow-controlled container options into Docker job container configuration while privileged mode is disabled. Host namespace settings, expanded capabilities, and security profile overrides can remain effective despite Privileged being forced false. A workflow author able to run jobs on an affected Docker-backed runner can use these options to access host namespaces and execute commands as root on the runner host, bypassing the intended container isolation.

Affected packages

Ecosystem	Package	Affected versions	Fixed versions
Go	gitea.com/gitea/runner	—	1.0.9-0.20260731160927-34bfa1915022

Remediation: Upgrade to 1.0.9-0.20260731160927-34bfa1915022 or later.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-73802

Includes data from the GitHub Advisory Database, licensed under CC-BY 4.0.

Includes data from the National Vulnerability Database (NIST). NVD data is in the public domain; this page is not endorsed by NIST.

CVE® is a registered trademark of The MITRE Corporation. CVE content reproduced under the CVE Terms of Use; copyright designation © MITRE.