CVE Intelligence
Analysis AI-assisted

CVE-2026-58053: Gitea act_runner Docker Backend Container Options Privilege Escalation

CVE-2026-58053 affects Gitea act_runner when it uses the Docker backend. According to the record, options in a workflow's container.options string, such as host PID namespace and added capabilities, can still be applied when privileged is set to false, which may let a user who can run workflows reach root on the host. The CNA reports a critical CVSS 3.1 score, the CVE is not listed in CISA KEV, and no confirmed exploitation appears in the sources consulted.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

This record describes a privilege management weakness in Gitea act_runner when it runs jobs with the Docker backend. The CNA states that the privileged flag is forced off when privileged is false, but other container options from the workflow are still merged into the job container configuration.

Impact

The CNA states that a user who can run a workflow on a Docker-backed runner may be able to escape to the host as root. The CNA's CVSS 3.1 vector indicates high confidentiality, integrity and availability impact with scope change. These statements come from the CNA record and have not been independently verified in this analysis.

Affected products and versions

  • The record names Gitea act_runner with the Docker backend, through act 0.262.0.
  • The structured affected and fixed version fields in the record are empty, so the exact affected range is not confirmed by the record.
  • Other act_runner versions, backends or configurations are not addressed by the record.

Exploitation status

  • The record shows the CVE is not listed in the CISA KEV catalog.
  • No confirmed exploitation in the wild appears in the sources consulted for this analysis.
  • The record references a public third-party repository; its content was not used to support any statement here.
  • EPSS shows a probability of 0.00442 with a percentile of 0.36655, dated 2026-10-13.

Remediation and mitigation

  • Check the project's official channels for an updated act_runner release that addresses this issue. The record does not identify a fixed version.
  • Limit who can create or modify workflows that run on Docker-backed runners, and review workflow changes before they execute.
  • Avoid sharing a runner host with sensitive workloads, and isolate runners where feasible.
  • Review and restrict which container options are permitted in your environment, and treat host namespace and capability settings as high-risk.
  • Apply the principle of least privilege to the Docker daemon and runner hosts.

Detection guidance

  • Audit workflow files for container options that request host namespaces, added capabilities or weakened security profiles.
  • Monitor Docker daemon logs and runner host logs for job containers started with unexpected host namespace or capability settings.
  • Alert on containers that access host paths or processes unexpectedly after a CI job starts.

Limitations of the available information

  • The record does not provide a fixed version, a patch or an affected version range in structured fields.
  • Whether the behaviour persists in every act_runner release or deployment configuration is unknown from the record.
  • The CVSS 3.1 and 4.0 scores come from the CNA and have not been checked against an independent assessment.
  • Exploitation activity beyond the sources consulted is unknown.

Frequently asked questions

What is CVE-2026-58053?

It is a reported privilege management flaw in Gitea act_runner using the Docker backend, where container options can still grant host namespaces and capabilities even when privileged is set to false, according to the CNA record.

Is this CVE being actively exploited?

The CVE is not listed in the CISA KEV catalog, and no confirmed exploitation appears in the sources consulted for this analysis.

Is there a fixed version available?

The record does not list a fixed version. Check the official project channels for an updated release.

What should administrators do now?

Restrict who can run or modify workflows on Docker-backed runners, avoid sensitive workloads on shared runner hosts, and audit workflows for host namespace or capability options.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.