Go/gitea.com/gitea/runner CVE-2026-73802: unknown, EPSS 0.47%
gitea-runner: workflow container.options passes host namespaces and capability flags to job container when privileged mode is disabled in gitea.com/gitea/runner
Action: Upgrade gitea.com/gitea/runner to 1.0.9-0.20260731160927-34bfa1915022 or later.
go get gitea.com/gitea/runner@v1.0.9-0.20260731160927-34bfa1915022Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 1.0.9-0.20260731160927-34bfa1915022 | - |
Fixed versions
| 1.0.9-0.20260731160927-34bfa1915022 |
Sources
- osv: GO-2026-6656
- https://github.com/go-gitea/gitea/security/advisories/GHSA-x4q3-gcj3-m6cf
- https://gitea.com/gitea/runner/pulls/1058
- https://gitea.com/gitea/runner/releases/tag/v3.0.0
CVE-2026-73802 · published · modified · JSON