Improper privilege management in Gitea Runner - CVE-2026-73802
Published: August 15, 2026
Vulnerability identifier: #VU142698
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-73802
CWE-ID: CWE-269
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to execute arbitrary commands as root on the runner host.
The vulnerability exists due to improper privilege management in gitea-runner job container HostConfig handling when processing workflow-controlled container.options. A remote user can submit a specially crafted workflow with container options that preserve host namespace, capability, and security profile flags to execute arbitrary commands as root on the runner host.
Exploitation requires the ability to submit a workflow to a repository using a Docker-backed shared runner.
Affected software
Gitea Runner
How to mitigate CVE-2026-73802
Install security update from vendor's website.
Gitea Runner - update to 3.0.0