Gitea act_runner Container Options Injection — Privileged CI/CD Escape

Ibrahim Saud@tektrix

•updated Jun 29, 2026•0•0•2

Detects the execution of Gitea/Act runner or Docker containers with dangerous configurations that allow host-level access, such as privileged mode, host PID/IPC namespaces, or disabled security profiles (AppArmor/Seccomp). These configurations are often used to escape container isolation or execute commands on the underlying host.