Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.9
Gitea Runner lets users alter Docker settings without privilege
published 2 days ago
Summary
The Gitea Runner component can accept container options that are defined in a workflow and apply them to the Docker container it starts, even when the runner is not running in privileged mode. This means a user could influence how the Docker container is built or run, potentially bypassing security restrictions. Update Gitea to the latest version or apply the vendor's recommended configuration changes to stop workflow‑controlled options from being passed.
What to do
- Update cleanstart gitea to version 1.27.3-r0.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| CleanStart | cleanstart | gitea |
< 1.27.3-r0 Fix: upgrade to 1.27.3-r0
|
Original advisory text
Gitea Runner passes workflow-controlled container options into Docker job container configuration while privileged mode is disabled
Security vulnerability affects the gitea package. Gitea Runner passes workflow-controlled container options into Docker job container configuration while privileged mode is disabled.
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker full control (estimated)
Timeline
Published17 Oct 2026
Updated17 Oct 2026
First seen17 Oct 2026
Sources
CLEANSTART-2026-DC26983 · OSV
Track software like this
Free during beta