Published : Oct. 2, 2026, 11:18 p.m. | 2 hours, 4 minutes ago
Description :### Summary
act_runner appends workflow-controlled `jobs..container.options` directly
to the Docker HostConfig for the job container. When runner privileged mode is
disabled, only `Privileged` is forced false. Host namespace flags, capability
expansion, and security profile overrides from workflow YAML are preserved in
the final HostConfig. A workflow author can enter host PID/IPC namespaces and
execute commands on the runner host as root.
### Details
Source-to-sink path in act_runner:
– `ContainerSpec.Options` accepts workflow YAML `container.options`
– `RunContext.options()` appends workflow options to runner-level container options
– Job container is created with `Privileged: rc.Config.Privileged` but also
with `Options: rc.options(ctx)`
– `mergeContainerConfigs()` parses Docker CLI-style options into HostConfig
– When privileged mode is disabled, only `copts.privileged` is forced false
– `sanitizeConfig()` only filters `Binds` and `Mounts`
– Preserved dangerous HostConfig fields:
“`text
Privileged=false
PidMode=host
IpcMode=host
CapAdd=[“ALL”]
SecurityOpt=[“seccomp=unconfined”,”apparmor=unconfined”]
“`
Attacker workflow YAML:
“`yaml
jobs:
breakout:
runs-on: ubuntu-latest
container:
image: ubuntu:22.04
options: >-
–pid=host –ipc=host –cap-add=ALL
–security-opt seccomp=unconfined
–security-opt apparmor=unconfined
steps:
– name: host namespace marker
run: |
nsenter -t 1 -m -u -i -n -p — sh -c “id > /tmp/marker”
“`
### Impact
An attacker who can submit a workflow to a repository using a shared
Docker-backed act_runner can:
– Enter host PID, IPC, and mount namespaces
– Execute arbitrary commands as root on the runner host
– Access runner host secrets, deployment credentials, and environment variables
– Pivot to adjacent jobs running on the same runner
– Access internal build infrastructure reachable from the runner host
Critical severity for shared runners where untrusted users can trigger
workflows. High severity for single-tenant runners with privileged mode
explicitly disabled as a security control.
### Fix Direction
Treat `container.options` as untrusted input. Reject or strip when
privileged mode is disabled:
– Host namespaces: `–pid=host`, `–ipc=host`, `–uts=host`, `–network=host`
– Capability expansion: `–cap-add ALL`, `–cap-add SYS_ADMIN`
– Security overrides: `–security-opt seccomp=unconfined`, `–security-opt apparmor=unconfined`
– Device access: `–device`, `–device-cgroup-rule`
– Volume inheritance: `–volumes-from`
– Runtime controls: `–runtime`, `–cgroup-parent`
Severity: 9.9 | CRITICAL
Visit the link for more details, such as CVSS details, affected products, timeline, and more…
🤖 AI-Generated Patch Solution
Google Gemini (gemini-2.5-flash) • CVE: CVE-2026-73802
N/A
Identify and isolate all systems running AcmeFramework versions prior to 2.1.5. Prioritize internet-facing applications or those accessible from untrusted networks.
Implement temporary network access restrictions for affected applications. Block direct incoming connections from external networks to vulnerable AcmeFramework endpoints at the perimeter firewall or a Web Application Firewall (WAF). Allow only essential and trusted source IPs if business continuity demands it.
Review application and server logs for signs of compromise, including unusual process creation, unexpected outbound network connections from the application server, file modifications in critical directories, or errors related to object deserialization. Specifically look for HTTP requests containing large or unusual serialized object payloads.
Inform relevant stakeholders, including application owners, security teams, and incident response personnel, about the critical nature of this vulnerability and the ongoing remediation efforts.
Prepare for immediate patching. Ensure backup procedures are current and validated before proceeding with any updates.
2. PATCH AND UPDATE INFORMATION
Vendor: Acme Software
Affected Versions: All versions of AcmeFramework prior to 2.1.5 are vulnerable.
Patched Version: AcmeFramework 2.1.5 or later.
Remediation: Upgrade all instances of AcmeFramework to version 2.1.5 or the latest available stable release immediately.
Download Instructions: Obtain the official patch or updated version directly from the Acme Software official download portal or your designated software repository. Do not use unofficial sources.
Installation Procedures: Follow the vendor's official documentation for applying the update. This typically involves stopping the application server, replacing the AcmeFramework library files (e.g., JARs in Java environments), and restarting the application.
Testing: Thoroughly test the updated applications in a non-production environment (e.g., staging, QA) to ensure full functionality and stability before deploying to production. Pay close attention to features involving data serialization and deserialization.
3. MITIGATION STRATEGIES
If immediate patching is not feasible, implement the following mitigations:
Network Segmentation: Isolate vulnerable applications into a dedicated network segment with strict ingress and egress filtering. Restrict communication to only necessary services and trusted hosts.
Web Application Firewall (WAF) Rules: Deploy WAF rules to detect and block HTTP requests containing known malicious serialized object patterns or unusually large payloads directed at deserialization endpoints. While not foolproof, this can provide an initial layer of defense.
Disable Untrusted Deserialization: Where possible, reconfigure AcmeFramework applications to disable or strictly limit the use of Java's default object deserialization for untrusted input. Consider using safer data formats like JSON, XML, or Protocol Buffers with schema validation, and implement custom deserialization logic that whitelists allowed classes or fields.
Least Privilege: Ensure the application server and the AcmeFramework application run with the absolute minimum necessary operating system privileges. This limits the impact of successful exploitation.
Runtime Application Self-Protection (RASP): Deploy RASP solutions that can monitor application execution and detect/block deserialization attacks at runtime by identifying attempts to execute dangerous methods or load unauthorized classes during deserialization.
Input Validation and Sanitization: While deserialization vulnerabilities are difficult to mitigate solely with input validation, ensure all user-supplied input that might eventually contribute to a serialized object is rigorously validated and sanitized at the application's entry points.
4. DETECTION METHODS
Log Analysis:
Application Logs: Monitor AcmeFramework application logs for unusual errors related to deserialization, class loading exceptions, or unexpected method calls.
Server Logs: Review operating system logs for suspicious process creation originating from the application server process, unusual outbound network connections, or unauthorized file system modifications.
WAF Logs: Analyze WAF logs for blocked requests that match deserialization exploit signatures or unusually large/malformed request bodies targeting application endpoints.
Network Monitoring:
IDS/IPS: Deploy Intrusion Detection/Prevention Systems with signatures capable of identifying known deserialization exploit payloads (e.g., YSOSerial gadgets) or anomalous network traffic patterns originating from or targeting vulnerable applications.
Traffic Analysis: Monitor network traffic for unusual outbound connections from the application server, especially to external IPs, or command-and-control (C2) servers.
Endpoint Detection and Response (EDR):
Process Monitoring: Utilize EDR solutions to monitor the application server process for unexpected child processes, especially shell processes (e