Gitea Act Runner Container Escape via Unsafe Container Options (CVE-2026-46331)

Ethan Andrews@eandrews

•updated Jun 28, 2026•1•0•5

Detects Gitea act_runner processes spawning Docker containers with dangerous configurations, such as privileged mode, host namespace mounts, or security-opt bypasses, followed by the execution of 'nsenter' or shell processes, which are indicative of a container escape attempt to the host.