CVE-2026-58053: Gitea Act Runner Privilege Escalation

CVE-2026-58053 Overview

CVE-2026-58053 is a container hardening bypass in Gitea act_runner when using the Docker backend, affecting versions through act 0.262.0. The runner passes a workflow's container.options string directly into the Docker job container's HostConfig. When administrators set privileged: false, the runner only clears the Privileged flag while merging dangerous options such as --pid=host, --cap-add, and --security-opt unchanged. A user who can trigger a workflow on a Docker-backed runner can spawn a job container with host namespaces and broad Linux capabilities, then escape to the host as root. This weakness is classified under [CWE-269: Improper Privilege Management].

Critical Impact
Authenticated Gitea users who can run workflows can escape a non-privileged Docker container and gain root access on the runner host.

Affected Products

Gitea act_runner with the Docker backend
act through version 0.262.0
Any Gitea deployment exposing workflow execution to lower-trust users

Discovery Timeline

2026-06-28 - CVE-2026-58053 published to NVD
2026-06-30 - Last updated in NVD database

Technical Details for CVE-2026-58053

Vulnerability Analysis

Gitea act_runner uses the act library to execute workflows inside Docker containers. Each workflow can declare a container.options string that is forwarded to the Docker Engine when creating the job container. The runner intends to enforce a hardening boundary through the privileged: false setting in its configuration file.

The enforcement logic only overrides the resulting HostConfig.Privileged field. All other flags parsed from container.options flow into HostConfig without validation or filtering. This includes flags that grant host-level namespace access and elevated Linux capabilities, which together are functionally equivalent to --privileged for escape purposes.

Root Cause

The root cause is an incomplete allowlist for container creation options. The runner treats Privileged as the only sensitive field while ignoring semantically equivalent options such as --pid=host, --net=host, --ipc=host, --cap-add=SYS_ADMIN, --security-opt apparmor=unconfined, --security-opt seccomp=unconfined, and volume mounts like -v /:/host. The privileged: false guardrail therefore provides no meaningful isolation.

Attack Vector

An attacker with permission to push a workflow file or trigger a pipeline supplies a container.options value that requests host PID namespace sharing and adds SYS_ADMIN or SYS_PTRACE capabilities. The runner starts the container with these flags intact. Inside the job, the attacker enumerates host processes, injects into a root process, or mounts the host filesystem to write to /etc/cron.d, achieving root code execution on the runner host. The PoC in the GitHub PoC Repository demonstrates the full escape chain, and additional context is available in the VulnCheck Security Advisory.

No verified exploit code is reproduced here. See the referenced advisories for technical details.

Detection Methods for CVE-2026-58053

Indicators of Compromise

Docker containers spawned by act_runner with HostConfig.PidMode, NetworkMode, or IpcMode set to host
Job containers with CapAdd entries such as SYS_ADMIN, SYS_PTRACE, or NET_ADMIN
Bind mounts of sensitive host paths such as /, /var/run/docker.sock, or /etc into workflow containers
Workflow YAML files containing a container.options key with --pid=host, --cap-add, --security-opt, or --privileged

Detection Strategies

Audit Docker Engine API calls from the act_runner process for HostConfig fields that indicate host namespace sharing or added capabilities
Parse repository workflow files during CI ingestion and flag any use of container.options beyond an approved allowlist
Correlate runner-initiated container creation events with subsequent process activity on the host, such as unexpected writes to /etc, /root, or systemd unit directories

Monitoring Recommendations

Enable Docker daemon audit logging and forward container.create events with full HostConfig payloads to a central log store
Monitor act_runner hosts for processes whose parent is a container runtime but which execute outside the expected container cgroup
Track new SSH keys, cron entries, or setuid binaries appearing on runner hosts, which indicate post-escape persistence

How to Mitigate CVE-2026-58053

Immediate Actions Required

Restrict workflow execution on Docker-backed act_runner instances to trusted users and trusted repositories only
Disable or remove support for the container.options field in workflows until a fixed act release is deployed
Isolate runner hosts on dedicated systems with no access to production credentials, secrets, or lateral network paths

Patch Information

No fixed version is listed in the NVD entry at time of publication. Monitor the VulnCheck Security Advisory and upstream act releases beyond 0.262.0 for an official fix. Apply vendor patches as soon as they are published.

Workarounds

Deploy runners inside a hardened virtual machine or microVM boundary so a container escape yields only VM-level access
Enforce an admission policy on the Docker socket, using tools such as an authorization plugin, to reject HostConfig values with PidMode=host, added capabilities, or unconfined security profiles
Configure act_runner to reject workflows whose YAML contains a container.options key through a pre-execution linter or Git server-side hook
Run the Docker daemon with user namespace remapping so container root does not map to host UID 0

bash

# Configuration example: Docker authorization plugin denylist concept
# Reject container create requests that share host namespaces or add capabilities
{
  "HostConfig": {
    "PidMode": "host",
    "NetworkMode": "host",
    "IpcMode": "host",
    "Privileged": true,
    "CapAdd": ["SYS_ADMIN", "SYS_PTRACE", "NET_ADMIN"],
    "SecurityOpt": ["apparmor=unconfined", "seccomp=unconfined"]
  }
}
# Any create request matching the above fields should be denied at the daemon layer.