{"action":"Upgrade gitea.com/gitea/runner to 1.0.9-0.20260731160927-34bfa1915022 or later.","affected":[{"fixed":"1.0.9-0.20260731160927-34bfa1915022","introduced":"0"}],"component":"gitea.com/gitea/runner","cve_ids":["CVE-2026-73802"],"ecosystem":"Go","epss":0.00472,"exploited":false,"fixed_versions":["1.0.9-0.20260731160927-34bfa1915022"],"ghsa_id":"GHSA-x4q3-gcj3-m6cf","id":"tcs_01M5KGVXZYF6A43WT3XYGD8ZWF","modified_at":"2026-10-07T17:45:12.474497003Z","published_at":"2026-10-07T14:10:14Z","references":["https://osv.dev/vulnerability/GO-2026-6656","https://github.com/go-gitea/gitea/security/advisories/GHSA-x4q3-gcj3-m6cf","https://gitea.com/gitea/runner/pulls/1058","https://gitea.com/gitea/runner/releases/tag/v3.0.0"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"GO-2026-6656","url":"https://osv.dev/vulnerability/GO-2026-6656"}],"summary":"gitea-runner: workflow container.options passes host namespaces and capability flags to job container when privileged mode is disabled in gitea.com/gitea/runner"}