CVE-2026-58053
CriticalCVSS 9.9Exploitation Probability (EPSS)
Low risk18th percentile — higher than 18% of all known CVEs
Summary
A vulnerability in Gitea act_runner with Docker backend (up to act 0.262.0) allows bypassing privileged mode restrictions. By passing container options like --pid=host, --cap-add, and --security-opt, a user can access host namespaces and escalate privileges to root.
Risk Assessment
The organization risks complete host takeover by an unprivileged user running a workflow. An attacker can access other containers, data, and network systems.
Recommendation
Immediately update Gitea act_runner to a version above 0.262.0. Until the update, restrict workflow execution to trusted users only.
Original NVD description (English source)
Gitea act_runner with the Docker backend (through act 0.262.0) passes a workflow's container.options string to the Docker job container's HostConfig and, when configured with privileged: false, forces only the Privileged flag off while merging options such as --pid=host, --cap-add, and --security-opt unchanged. A user who can run a workflow on a Docker-backed runner can create a job container with host namespaces and broad capabilities and escape to the host as root despite privileged mode being disabled.