---
title: "CVE-2026-73802: gitea-runner: workflow container.options passes host namespaces and capability flags to job container when privileged mode is disabled"
url: https://erroneo.us/security/cve/CVE-2026-73802/
description: "CVE-2026-73802 (gitea.com/gitea/runner (Go)): Gitea Runner passes workflow-controlled container options into Docker job container configuration while…"
type: vulnerability-record
section: "Security Digest"
date_published: 2026-10-14
date_modified: 2026-10-18
publisher: erroneo.us
author: erroneo.us Security Desk
cve: "CVE-2026-73802"
kev: false
cvss: 8.8
epss: 0.00472
license: All rights reserved. Quote with attribution and a link.
---

# CVE-2026-73802: gitea-runner: workflow container.options passes host namespaces and capability flags to job container when privileged mode is disabled

**Signal:** Normal patch cycle. No exploitation signal; fix it in your next routine update if you are affected. (Computed from CISA KEV, EPSS and CVSS; not an editorial verdict.)

## Should you act?

- No confirmed exploitation. It is not in CISA’s KEV catalog and CISA’s SSVC assessment records no known exploitation. That can change quickly after a public write-up; re-check if you are affected.
- EPSS 0.5% , percentile 40: FIRST’s model estimates a 0.5% chance of exploitation activity in the next 30 days, higher than 40% of all scored CVEs (low). EPSS is a probability, not a verdict.
- Needs an account (low (any account)). Exposure depends on who can log in.
- Only applies if your dependency tree includes gitea.com/gitea/runner (Go) < 1.0.9-0.20260731160927-34bfa1915022, fixed in 1.0.9-0.20260731160927-34bfa1915022 . Check your lockfile, including transitive dependencies.

## What it is

Gitea Runner passes workflow-controlled container options into Docker job container configuration while privileged mode is disabled. Host namespace settings, expanded capabilities, and security profile overrides can remain effective despite Privileged being forced false. A workflow author able to run jobs on an affected Docker-backed runner can use these options to access host namespaces and execute commands as root on the runner host, bypassing the intended container isolation.

## Affected packages

- Go `gitea.com/gitea/runner` < 1.0.9-0.20260731160927-34bfa1915022 → fixed: 1.0.9-0.20260731160927-34bfa1915022

## Affected products (CVE record)

- Gitea Gitea Runner: < 3.0.0

## Severity

- CISA-ADP CVSS 3.1: 8.8 `CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`
- GitHub CVSS 3.1: 9.9 `CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H`

## Exploitation

- CISA KEV: not listed (no confirmed in-the-wild exploitation known to CISA).
- CISA SSVC assessment: exploitation none , automatable no , technical impact total .
- FIRST EPSS (model of 2026-10-21): 0.47% probability of exploitation activity in the next 30 days; percentile 40.

## Sources

- [GitHub Security Advisory GHSA-x4q3-gcj3-m6cf](https://github.com/go-gitea/gitea/security/advisories/GHSA-x4q3-gcj3-m6cf)
- [Gitea Runner 3.0.0 release announcement](https://blog.gitea.com/release-of-runner-3.0.0/)
- [gitea/runner v3.0.0 release](https://gitea.com/gitea/runner/releases/tag/v3.0.0)
- [GitHub Advisory GHSA-x4q3-gcj3-m6cf](https://github.com/advisories/GHSA-x4q3-gcj3-m6cf)
- [CVE.org record CVE-2026-73802](https://www.cve.org/CVERecord?id=CVE-2026-73802)
- [NVD entry CVE-2026-73802](https://nvd.nist.gov/vuln/detail/CVE-2026-73802)
- [gitea.com](https://gitea.com/gitea/runner/pulls/1058)

---
Source page: https://erroneo.us/security/cve/CVE-2026-73802/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt