Security researchers are warning organizations using Gitea act_runner with the Docker backend to review their deployments after proof-of-concept (PoC) code for CVE-2026-58053 was publicly released as part of the recently disclosed Exploitarium repository.
The vulnerability was one of dozens of previously undisclosed security flaws published by an anonymous researcher known as “bikini.” The repository, which contained proof-of-concept exploits targeting multiple vendors and open-source projects, was later removed from GitHub. However, mirror copies and technical analyses remain publicly available.
Unlike earlier reports that referenced an authentication bypass vulnerability, the disclosed issue affecting Gitea is actually CVE-2026-58053, a critical privilege management flaw in Gitea act_runner that can allow an attacker with workflow execution privileges to escape a Docker container and obtain root-level access on the host system.
CVE-2026-58053 Enables Container Escape
CVE-2026-58053 affects Gitea act_runner when configured with the Docker backend through act 0.262.0.
According to the published advisory, the runner passes a workflow’s container.options directly into Docker’s container configuration. Even when the runner is configured with privileged: false, only the Docker Privileged flag is disabled. Other potentially dangerous options—including --pid=host, --cap-add, and --security-opt—are still merged into the container configuration without sufficient restriction.
An authenticated user who can execute workflows on a Docker-backed runner can abuse these options to create a job container with elevated capabilities and host namespaces, potentially escaping the container and gaining root-level access to the underlying host.
The vulnerability has been assigned a CVSS v3.1 score of 9.9 (Critical) and is categorized as Improper Privilege Management (CWE-269).
Public Release Raises Security Concerns
The flaw became widely known after it appeared in the Exploitarium repository—a collection of proof-of-concept exploits for dozens of vulnerabilities affecting enterprise software, networking products, and open-source applications.
According to reports, the repository was published without coordinated vendor disclosure, giving defenders little time to prepare before exploit code became publicly accessible. Security researchers also noted that at least two vulnerabilities included in the release had already been observed being exploited in the wild, highlighting the operational risks posed by large-scale public exploit dumps.
The incident has also reignited discussion around the role of AI-assisted vulnerability discovery and the increasing volume of exploitable security research being released without prior coordination with affected vendors.
Potential Impact
Organizations using Gitea act_runner with the Docker backend should evaluate whether untrusted users can execute workflows.
If exploited, CVE-2026-58053 could allow an attacker to:
- Escape the intended Docker container isolation.
- Gain root-level access on the host running the CI/CD runner.
- Compromise the confidentiality, integrity, and availability of the host system.
- Pivot to additional systems within the environment after obtaining elevated privileges.
The vulnerability requires the attacker to have permission to run workflows on the affected runner but can have significant consequences once that access is obtained.
Mitigation Recommendations
Organizations using Gitea act_runner should consider the following defensive measures:
- Apply vendor updates as soon as patched versions become available.
- Restrict workflow execution permissions to trusted users and repositories.
- Avoid executing untrusted workflows on Docker-backed runners.
- Review runner configurations for unnecessary Docker capabilities and excessive privileges.
- Monitor systems for unusual workflow activity or signs of container escape attempts.
- Continue monitoring Gitea security advisories for updated remediation guidance.
Conclusion
The publication of CVE-2026-58053 demonstrates the growing operational risks associated with publicly released exploit repositories. Even when vulnerabilities require authenticated access, flaws affecting CI/CD infrastructure can provide attackers with a path to compromise build environments and underlying hosts.
Organizations operating self-hosted Gitea deployments should review their act_runner configurations, restrict workflow execution to trusted users, and prioritize security updates as new guidance becomes available.
Editor’s Note: This article has been updated to reflect corrected reporting regarding the affected vulnerability. Earlier reports referenced CVE-2026-20896; however, subsequent corrections identified the disclosed issue as CVE-2026-58053, which affects Gitea act_runner when using the Docker backend. The page URL has been retained to preserve existing links and references.
