PT-2026-105548 · Go · Gitea.Com/Gitea/Runner

Published

2026-10-02

·

Updated

2026-10-02

CVSS v3.1

9.9

Critical

VectorAV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Summary

act runner appends workflow-controlled jobs.<job>.container.options directly to the Docker HostConfig for the job container. When runner privileged mode is disabled, only Privileged is forced false. Host namespace flags, capability expansion, and security profile overrides from workflow YAML are preserved in the final HostConfig. A workflow author can enter host PID/IPC namespaces and execute commands on the runner host as root.

Details

Source-to-sink path in act runner:
  • ContainerSpec.Options accepts workflow YAML container.options
  • RunContext.options() appends workflow options to runner-level container options
  • Job container is created with Privileged: rc.Config.Privileged but also with Options: rc.options(ctx)
  • mergeContainerConfigs() parses Docker CLI-style options into HostConfig
  • When privileged mode is disabled, only copts.privileged is forced false
  • sanitizeConfig() only filters Binds and Mounts
  • Preserved dangerous HostConfig fields:
text
Privileged=false
PidMode=host
IpcMode=host
CapAdd=["ALL"]
SecurityOpt=["seccomp=unconfined","apparmor=unconfined"]
Attacker workflow YAML:
yaml
jobs:
 breakout:
  runs-on: ubuntu-latest
  container:
   image: ubuntu:22.04
   options: >-
    --pid=host --ipc=host --cap-add=ALL 
    --security-opt seccomp=unconfined 
    --security-opt apparmor=unconfined
  steps:
   - name: host namespace marker
    run: |
     nsenter -t 1 -m -u -i -n -p -- sh -c "id > /tmp/marker"

Impact

An attacker who can submit a workflow to a repository using a shared Docker-backed act runner can:
  • Enter host PID, IPC, and mount namespaces
  • Execute arbitrary commands as root on the runner host
  • Access runner host secrets, deployment credentials, and environment variables
  • Pivot to adjacent jobs running on the same runner
  • Access internal build infrastructure reachable from the runner host
Critical severity for shared runners where untrusted users can trigger workflows. High severity for single-tenant runners with privileged mode explicitly disabled as a security control.

Fix Direction

Treat container.options as untrusted input. Reject or strip when privileged mode is disabled:
  • Host namespaces: --pid=host, --ipc=host, --uts=host, --network=host
  • Capability expansion: --cap-add ALL, --cap-add SYS ADMIN
  • Security overrides: --security-opt seccomp=unconfined, --security-opt apparmor=unconfined
  • Device access: --device, --device-cgroup-rule
  • Volume inheritance: --volumes-from
  • Runtime controls: --runtime, --cgroup-parent

Fix

Improper Privilege Management

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-269

Related Identifiers

GHSA-X4Q3-GCJ3-M6CF

Affected Products

Gitea.Com/Gitea/Runner