CVE-2026-58053

Name of the Vulnerable Software and Affected Versions Gitea act runner versions prior to 0.262.0

Description When using the Docker backend, the software passes the container.options string from a workflow to the Docker job container's HostConfig. If privileged is set to false, the system only disables the Privileged flag but merges other options such as --pid=host, --cap-add, and --security-opt without changes. This allows a user capable of running a workflow on a Docker-backed runner to create a job container with host namespaces and broad capabilities, enabling a container escape to the host system with root privileges.

Recommendations Update Gitea act runner to version 0.262.0 or later.