Gitea act_runner vulnerabilities

Latest Gitea act_runner CVEs

Newest publication first

1. CVE-2026-58053 Gitea act_runner - Container Hardening Bypass via Workflow Container Options

   Published 2026-06-28

   Critical·CVSS 9.4 EPSS 0.44%

   Gitea act_runner with the Docker backend (through act 0.262.0) passes a workflow's container.options string to the Docker job container's HostConfig and, when configured with privileged: false, forces only the Privileged flag off while merging options such as --pid=host, --cap-ad...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.