Gitea Runner: workflow-controlled container options bypass forced non-privileged mode and give root on the runner host

Impact

The runner passes container options taken from the workflow definition into the Docker job container config. Even with privileged mode forced off, host namespace settings, added capabilities and security-profile overrides still take effect, so a workflow author can break out of the job container and run commands as root on the runner host. On a GPU fleet this matters where CI runners sit on or beside accelerator nodes: host root gives the attacker the runner's registry and deploy credentials, any other tenants' jobs on the same host, and the GPU device nodes the host exposes. Jobs are self-service, so the attacker only needs the ability to push a workflow to a repository that targets an affected Docker-backed runner.

Who can reach it

Any authenticated user who can cause a workflow to run on an affected Docker-backed Gitea runner - typically anyone able to push a branch or open a pull request in a repository that uses that runner. No access to the runner host itself is needed.

What to do

Upgrade Gitea Runner to 3.0.0, which is where the fix shipped. That means stopping the runner daemon and restarting it on the new version; queued jobs drain or restart, but the host does not need a reboot. Until upgraded, restrict which repositories may target Docker-backed runners and treat any workflow-author as holding host root on those runner machines.

References

Related entries

• Linux octeontx2-af (VF clobbering shared CGX PKIND state): PF and VF NIX logical functions that share a CGX MAC reuseCVE-2026-74527 · Linux octeontx2-af (VF clobbering shared CGX PKIND state)High
• SkyPilot (API server, service account role update authorization): SkyPilot never checks whether the caller is entitledCVE-2026-75481 · SkyPilot (API server, service account role update authorization)High
• Citrix NetScaler ADC/Gateway: memory overflow in Gateway and AAA vservers causes denial of serviceCVE-2026-8452 · Citrix NetScaler ADC / Gateway (Gateway and AAA virtual servers)High
• Jenkins: config.xml nested objects reachable via Stapler give authenticated users remote code executionCVE-2026-84645 · Jenkins controller (config.xml submission, Stapler request routing)High
• Jenkins Stapler: form data binding instantiates configuration types the target field never expectedCVE-2026-84647 · Jenkins Stapler (form data binding type restriction)High
• Jenkins: unescaped system log metadata lets an agent-controlled process store XSS in the controller UICVE-2026-84648 · Jenkins controller (system log viewer, log record metadata escaping)High