CVE-2026-20253 Gitea Act Runner Container Option Injection for Host Escape

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•5

This rule detects the execution of Docker containers or related CI/CD runner processes (like Gitea act_runner) with insecure configuration options. These options, such as --privileged, --pid=host, or mounting the Docker socket, can facilitate container escapes or unauthorized host-level access.