CVE-2026-73802 Gitea CVE debrief

Who should care

Defenders responsible for gitea-runner deployments, especially those with untrusted workflow authors, should assess exposure and verify the security of their environments. This includes operators, platform administrators, vulnerability management teams, and security teams who need to understand the potential impact of this vulnerability on their systems and take appropriate measures to mitigate the risk.

Why it matters

This vulnerability allows workflow authors to execute commands on the runner host as root when privileged mode is disabled, potentially leading to host compromise.

• Potential for workflow authors to execute commands on the runner host as root
• Ability for attackers to enter host PID/IPC namespaces
• Preservation of dangerous HostConfig fields such as PidMode=host, IpcMode=host, CapAdd=[ALL], and SecurityOpt=[seccomp=unconfined,apparmor=unconfined]

Technical summary

The gitea-runner appends workflow-controlled container options directly to the Docker HostConfig for the job container. When runner privileged mode is disabled, only the Privileged flag is forced false, while host namespace flags, capability expansion, and security profile overrides from workflow YAML are preserved in the final HostConfig. This allows workflow authors to execute commands on the runner host as root when privileged mode is disabled, potentially leading to host compromise. A workflow author can enter host PID/IPC namespaces and execute commands on the runner host as root.

Defensive priority

Defenders should prioritize verifying exposure and assessing the security of their gitea-runner deployments, especially those with untrusted workflow authors.

Recommended defensive actions

• Verify gitea-runner version and assess exposure
• Restrict workflow authors to trusted users
• Monitor for suspicious workflow activity
• Implement compensating controls to limit host access
• Review relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability is confirmed in gitea-runner versions prior to 1.0.9-0.20260731160927-34bfa1915022. The CVE Program and NVD records provide additional context. Source item osv_dev provides vulnerability details. Defenders should verify exposure and assess the security of their gitea-runner deployments, especially those with untrusted workflow authors.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.