The act_runner component of gitea.com/gitea/runner appends workflow-controlled container.options directly to the Docker HostConfig for job containers. When privileged mode is disabled, only the Privileged flag is forced false, but host namespace flags (e.g., --pid=host, --ipc=host), capability expansions (e.g., --cap-add=ALL), and security profile overrides (e.g., seccomp=unconfined) from the workflow YAML are preserved. This allows a workflow author to execute commands as root on the runner host by entering host namespaces. The vulnerability affects versions prior to 1.0.9-0.20260731160927-34bfa1915022. The recommended fix is to treat container.options as untrusted input and reject or strip dangerous options when privileged mode is disabled.

An attacker able to submit workflows to a repository using a shared Docker-backed act_runner can enter host PID, IPC, and mount namespaces and execute arbitrary commands as root on the runner host. This enables access to host secrets, deployment credentials, environment variables, and internal build infrastructure. The attacker can also pivot to other jobs running on the same runner. The vulnerability is critical for shared runners with untrusted users and high severity for single-tenant runners relying on privileged mode disabling as a security control.

A patch is available for this vulnerability. The fix involves rejecting or stripping unsafe container.options such as host namespaces (--pid=host, --ipc=host, --uts=host, --network=host), capability expansions (--cap-add ALL, --cap-add SYS_ADMIN), security overrides (--security-opt seccomp=unconfined, --security-opt apparmor=unconfined), device access options, volume inheritance, and runtime controls when privileged mode is disabled. Users should upgrade to version 1.0.9-0.20260731160927-34bfa1915022 or later where this issue is addressed.