{"id":"GO-2026-6656","revision":"3df80ec52a7243c59bef56719c0e6280","records":[{"revision":"3df80ec52a7243c59bef56719c0e6280","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GO-2026-6656","aliases":["CVE-2026-73802","GHSA-x4q3-gcj3-m6cf"],"title":"gitea-runner: workflow container.options passes host namespaces and capability flags to job container when privileged mode is disabled in gitea.com/gitea/runner","description":"gitea-runner: workflow container.options passes host namespaces and capability flags to job container when privileged mode is disabled in gitea.com/gitea/runner","state":0,"publishedAt":"2026-10-07T14:10:14+00:00","modifiedAt":"2026-10-07T17:45:12.474497+00:00","affected":[{"ecosystem":"Go","name":"gitea.com/gitea/runner","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"1.0.9-0.20260731160927-34bfa1915022"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/go-gitea/gitea/security/advisories/GHSA-x4q3-gcj3-m6cf","https://gitea.com/gitea/runner/pulls/1058","https://gitea.com/gitea/runner/releases/tag/v3.0.0"],"sourceUrl":"https://osv.dev/vulnerability/GO-2026-6656","license":"OSV · upstream source license applies","key":"osv:GO-2026-6656","identifiers":["GO-2026-6656","CVE-2026-73802","GHSA-x4q3-gcj3-m6cf"]},"retained":false,"historicalAffected":[]}],"coverage":[]}