CVE-2026-58053: gitea act_runner Improper Privilege Management

Vulnerability summary

CVE-2026-58053 is a critical (CVSS 9.9) Improper Privilege Management vulnerability in gitea act_runner. EPSS estimates a 0.44% chance of exploitation in the next 30 days, higher than 37.1% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 28-06-2026
   PublishedVulnerability first disclosed.
2. 30-06-2026
   Last modifiedVulnerability information updated.

Description

Gitea act_runner with the Docker backend (through act 0.262.0) passes a workflow's container.options string to the Docker job container's HostConfig and, when configured with privileged: false, forces only the Privileged flag off while merging options such as --pid=host, --cap-add, and --security-opt unchanged. A user who can run a workflow on a Docker-backed runner can create a job container with host namespaces and broad capabilities and escape to the host as root despite privileged mode being disabled.

• CWE-269Improper Privilege ManagementThe product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.