CVE-2026-58053 Gitea act_runner - Container Hardening Bypass via Workflow Container Options
Attackers can escape Docker containers to gain root access on the host by injecting unsafe container options in Gitea act_runner workflows.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-58053?
CVE-2026-58053 is a critical vulnerability in Gitea act_runner, published on 28 Jun 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Gitea act_runner with the Docker backend (through act 0.262.0) passes a workflow's container.options string to the Docker job container's HostConfig and, when configured with privileged: false, forces only the Privileged flag off while merging options such as --pid=host, --cap-add, and --security-opt unchanged. A user who can run a workflow on a Docker-backed runner can create a job container with host namespaces and broad capabilities and escape to the host as root despite privileged mode being disabled.
Weakness: CWE-269
Which versions are affected by CVE-2026-58053?
How do I fix CVE-2026-58053?
No fix has been published for CVE-2026-58053 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-58053 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-58053 exists.
Sources
Also known as GHSA-8qf9-pc52-j7cm.