CVE-2026-58053: Gitea act_runner - Container Hardening Bypass via Workflow Container Options
Gitea actrunner with the Docker backend (through act 0.262.0) passes a workflow's container.options string to the Docker job container's HostConfig and, when configured with privileged: false, forces only the Privileged flag off while merging options such as --pid=host, --cap-add, and --security-opt unchanged. A user who can run a workflow on a Docker-backed runner can create a job container with host namespaces and broad capabilities and escape to the host as root despite privileged mode being disabled.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Gitea act_runner (Docker backend)to a version that resolves this vulnerability.Fixed in 0.262.0 - Compensating control
For Docker-backed Gitea act_runner jobs, restrict workflow/container options so that user-controlled settings cannot add dangerous HostConfig options (e.g., --pid=host, --cap-add, or security-opt overrides) that allow namespace/capability escape even when privileged is configured as false.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-58053?
CVE-2026-58053 has a critical severity rating of 9.9.
What types of systems are affected by CVE-2026-58053?
CVE-2026-58053 affects Gitea act_runner when utilizing the Docker backend.
How do I fix CVE-2026-58053?
To fix CVE-2026-58053, ensure that the configuration for the Gitea act_runner Docker backend does not allow unsafe container options.
What are the potential impacts of CVE-2026-58053?
The potential impacts of CVE-2026-58053 include an unauthorized bypass of container hardening measures, which can lead to container escape.
How can CVE-2026-58053 be exploited?
CVE-2026-58053 can be exploited by manipulating a workflow's container.options string to include unsafe Docker options when the container is run.