Gitea Runner passes workflow-controlled container options into Docker job container configuration while privileged mode is disabled. Host namespace settings, expanded capabilities, and security profile overrides can remain effective despite Privileged being forced false. A workflow author able to run jobs on an affected Docker‑backed runner can use these options to access host namespaces and execute commands as root on the runner host, bypassing the intended container isolation.

The vulnerability affects the Gitea Runner component. While a specific affected version list is not provided, the references point to the 3.0.0 release, implying that earlier releases prior to that version may be susceptible.

The vulnerability permits a workflow author—someone who already has permission to run jobs—to gain unrestricted access to the runner host. By passing unrestricted container options, the attacker can access host namespaces and execute commands with root privileges on the machine that hosts the runner. The advisory does not list the vulnerability in the CISA KEV catalog at this time, indicating that there is no known widespread exploitation yet, though the attack vector requires a malicious workflow author and a Docker‑based runner. The EPSS score is less than 1%, suggesting a low likelihood of exploitation but it is not zero.