{"id":"EUVD-2026-101107","enisaUuid":"07b99cd5-8f66-338c-820f-e109943bd5d8","description":"Gitea Runner passes workflow-controlled container options into Docker job container configuration while privileged mode is disabled. Host namespace settings, expanded capabilities, and security profile overrides can remain effective despite Privileged being forced false. A workflow author able to run jobs on an affected Docker-backed runner can use these options to access host namespaces and execute commands as root on the runner host, bypassing the intended container isolation.","datePublished":"Oct 14, 2026, 2:37:55 PM","dateUpdated":"Oct 18, 2026, 1:34:49 PM","baseScore":8.8,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","references":"https://github.com/go-gitea/gitea/security/advisories/GHSA-x4q3-gcj3-m6cf\nhttps://blog.gitea.com/release-of-runner-3.0.0/\nhttps://gitea.com/gitea/runner/releases/tag/v3.0.0\n","aliases":"CVE-2026-73802\nGHSA-x4q3-gcj3-m6cf\n","assigner":"Gitea","epss":0.55,"enisaIdProduct":[{"id":"73b2735c-7823-3f6b-9d69-4a5d0b3ad1cb","product":{"name":"Gitea Runner","vendor":{"name":"Gitea"}},"product_version":"0 \u003c3.0.0"}],"enisaIdVendor":[{"id":"a1d8d9e0-cbd2-3be0-876a-2bd66e093084","vendor":{"name":"Gitea"}}],"enisaIdVulnerability":[{"id":"2b08f6e6-8f2f-3dc5-a6e3-a3918eaab3b9","vulnerability":{"id":"GHSA-x4q3-gcj3-m6cf","description":"gitea-runner: workflow container.options passes host namespaces and capability flags to job container when privileged mode is disabled","datePublished":"Oct 2, 2026, 11:18:12 PM","dateUpdated":"Oct 2, 2026, 11:18:12 PM","baseScore":0.0,"references":"https://github.com/go-gitea/gitea/security/advisories/GHSA-x4q3-gcj3-m6cf\nhttps://gitea.com/gitea/runner/pulls/1058\nhttps://gitea.com/gitea/runner/releases/tag/v3.0.0\nhttps://github.com/go-gitea/gitea\n","enisa_id":"EUVD-2026-101107\n","aliases":"GHSA-x4q3-gcj3-m6cf\nCVE-2026-73802\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:07:07 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"574b2ca1-712d-3121-8023-578faa4a853d","vulnerability":{"id":"CVE-2026-73802","description":"Gitea Runner passes workflow-controlled container options into Docker job container configuration while privileged mode is disabled. Host namespace settings, expanded capabilities, and security profile overrides can remain effective despite Privileged being forced false. A workflow author able to run jobs on an affected Docker-backed runner can use these options to access host namespaces and execute commands as root on the runner host, bypassing the intended container isolation.","datePublished":"Oct 14, 2026, 2:37:55 PM","dateUpdated":"Oct 18, 2026, 1:34:49 PM","status":"PUBLISHED","baseScore":8.8,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","references":"https://github.com/go-gitea/gitea/security/advisories/GHSA-x4q3-gcj3-m6cf\nhttps://blog.gitea.com/release-of-runner-3.0.0/\nhttps://gitea.com/gitea/runner/releases/tag/v3.0.0\n","enisa_id":"EUVD-2026-101107\n","assigner":"Gitea","epss":0.55,"dataProcessed":"Nov 1, 2026, 7:15:04 AM","vulnerabilityProduct":[{"id":"52dc23eb-f0f1-3551-a8ed-96cb9d6eec55","product":{"name":"Gitea Runner","vendor":{"name":"Gitea"}},"product_version":"0 \u003c3.0.0"}],"vulnerabilityVendor":[{"id":"6a29d089-51e3-3de9-bf9b-1eb6c88a23e5","vendor":{"name":"Gitea"}}]}}],"enisaIdAdvisory":[]}