Gitea act_runner up to 0.262.0 Docker Backend privileges management

Summaryinfo

A vulnerability has been found in Gitea act_runner up to 0.262.0 and classified as critical. This affects an unknown function of the component Docker Backend. This manipulation causes privileges management. This vulnerability appears as CVE-2026-58053. The attack may be initiated remotely. In addition, an exploit is available.

Detailsinfo

A vulnerability has been found in Gitea act_runner up to 0.262.0 and classified as critical. Affected by this vulnerability is an unknown part of the component Docker Backend. The manipulation with an unknown input leads to a privileges management vulnerability. The CWE definition for the vulnerability is CWE-269. The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

Gitea act_runner with the Docker backend (through act 0.262.0) passes a workflow's container.options string to the Docker job container's HostConfig and, when configured with privileged: false, forces only the Privileged flag off while merging options such as --pid=host, --cap-add, and --security-opt unchanged. A user who can run a workflow on a Docker-backed runner can create a job container with host namespaces and broad capabilities and escape to the host as root despite privileged mode being disabled.

The weakness was presented by ashdfrkl. It is possible to read the advisory at github.com. This vulnerability is known as CVE-2026-58053 since 06/28/2026. The exploitation appears to be easy. The attack can be launched remotely. Technical details are unknown but a public exploit is available. The attack technique deployed by this issue is T1068 according to MITRE ATT&CK.

It is possible to download the exploit at github.com. It is declared as proof-of-concept.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-39973). Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• Gitea

Name

• act_runner

Version

• 0.262

License

• open-source

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion