Gitea act_runner container options injection host escape CVE-2026-20896

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•5

Detects Gitea act_runner spawning Docker containers with dangerous runtime flags (e.g., --pid=host, --privileged, --cap-add=ALL) that facilitate host namespace escape. This activity is indicative of exploitation of CVE-2026-20896, where malicious CI/CD workflow YAML files inject these options to break out of the container sandbox and access the host filesystem.