Gitea Act Runner container options abuse for container escape (CVE-2026-46331)

Ibrahim Saud@tektrix

•updated Jun 29, 2026•0•0•0

Detects anomalous process execution patterns associated with the Gitea Act Runner that indicate attempts to break out of container isolation. This includes the use of sensitive Docker flags like --privileged, --pid=host, or --ipc=host, the mounting of the Docker daemon socket, or the execution of nsenter to gain access to the host namespace, which are indicative of container escape techniques.