CVE-2026-20896 Gitea Docker X-WEBAUTH-USER Admin Impersonation & act-runner Container Escape

Ibrahim Saud@tektrix

•updated Jun 29, 2026•0•0•2

This rule detects two distinct malicious activities related to Gitea installations: 1) Container escape attempts involving 'act-runner' processes configured with dangerous flags like --pid=host, --cap-add=ALL, or usage of nsenter, and 2) Potential administrative impersonation attempts against a Gitea instance via injection of the X-WEBAUTH-USER: admin HTTP header.