Gitea Runner Privilege Escalation via container.options Host Namespace/Capability Injection (CVE-2026-73802)

let suspiciousOpts = dynamic(["--privileged","--pid=host","--pid host","--network=host","--net=host","--userns=host","--ipc=host","--uts=host","--cap-add","CAP_SYS_ADMIN","SYS_ADMIN","--device","/var/run/docker.sock","docker.sock"]);
DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName in~ ("docker","dockerd","containerd","runc","podman") or ProcessCommandLine has_any ("docker run","container create","docker create")
| where InitiatingProcessFileName in~ ("act_runner","gitea-runner","runner") or ProcessCommandLine has_any ("act_runner","gitea","GITEA_")
| where ProcessCommandLine has_any (suspiciousOpts)
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, FileName, ProcessCommandLine, InitiatingProcessCommandLine
| order by Timestamp desc

index=* (sourcetype="linux:auditd" OR sourcetype="docker" OR sourcetype="linux_secure" OR sourcetype="syslog")
(process_name="docker" OR process_name="dockerd" OR process_name="containerd" OR process_name="runc" OR process_name="podman" OR "docker run" OR "container create")
(parent_process="act_runner" OR parent_process="gitea-runner" OR "act_runner" OR "GITEA_")
("--privileged" OR "--pid=host" OR "--pid host" OR "--network=host" OR "--net=host" OR "--userns=host" OR "--ipc=host" OR "--uts=host" OR "--cap-add" OR "CAP_SYS_ADMIN" OR "SYS_ADMIN" OR "--device" OR "/var/run/docker.sock" OR "docker.sock")
| table _time, host, user, parent_process, process_name, process
| sort - _time

process where event.type == "start" and
  (process.name in ("docker","dockerd","containerd","runc","podman") or process.command_line : ("*docker run*","*container create*","*docker create*")) and
  (process.parent.name in ("act_runner","gitea-runner") or process.command_line : ("*act_runner*","*GITEA_*")) and
  process.command_line : ("*--privileged*","*--pid=host*","*--network=host*","*--net=host*","*--userns=host*","*--ipc=host*","*--uts=host*","*--cap-add*","*CAP_SYS_ADMIN*","*--device*","*/var/run/docker.sock*","*docker.sock*")

SELECT QIDNAME(qid) AS event, "sourceip", "username", "Process Name" AS process, "Parent Process Name" AS parent, "Command" AS command, starttime FROM events WHERE ("Process Name" ILIKE '%docker%' OR "Process Name" ILIKE '%containerd%' OR "Process Name" ILIKE '%runc%' OR "Command" ILIKE '%docker run%' OR "Command" ILIKE '%container create%') AND ("Parent Process Name" ILIKE '%act_runner%' OR "Command" ILIKE '%act_runner%' OR "Command" ILIKE '%GITEA_%') AND ("Command" ILIKE '%--privileged%' OR "Command" ILIKE '%--pid=host%' OR "Command" ILIKE '%--network=host%' OR "Command" ILIKE '%--userns=host%' OR "Command" ILIKE '%--ipc=host%' OR "Command" ILIKE '%--cap-add%' OR "Command" ILIKE '%CAP_SYS_ADMIN%' OR "Command" ILIKE '%--device%' OR "Command" ILIKE '%docker.sock%') ORDER BY starttime DESC LAST 24 HOURS

_sourceCategory=*linux* OR _sourceCategory=*docker* OR _sourceCategory=*auditd*
| where (process_name matches /docker|dockerd|containerd|runc|podman/ or _raw matches /docker run|container create/)
| where (_raw matches /act_runner|gitea-runner|GITEA_/)
| where (_raw matches /--privileged|--pid=host|--network=host|--net=host|--userns=host|--ipc=host|--uts=host|--cap-add|CAP_SYS_ADMIN|--device|docker\.sock/)
| fields _messagetime, _sourcehost, process_name, _raw
| sort by _messagetime desc

rule gitea_runner_cve_2026_73802_priv_container {
  meta:
    author = "argus"
    description = "Gitea act_runner spawns job container with host namespaces/capabilities/privileged flags (CVE-2026-73802)"
    severity = "CRITICAL"
  events:
    $e.metadata.event_type = "PROCESS_LAUNCH"
    (
      $e.principal.process.file.full_path = /docker|dockerd|containerd|runc|podman/ nocase or
      $e.target.process.command_line = /docker run|container create/ nocase
    )
    (
      $e.principal.process.parent_process.file.full_path = /act_runner|gitea-runner/ nocase or
      $e.target.process.command_line = /act_runner|GITEA_/ nocase
    )
    $e.target.process.command_line = /--privileged|--pid=host|--network=host|--net=host|--userns=host|--ipc=host|--uts=host|--cap-add|CAP_SYS_ADMIN|--device|docker\.sock/ nocase
  condition:
    $e
}

#event_simpleName=/ProcessRollup2|ProcessCreate/
| (ImageFileName=/docker|dockerd|containerd|runc|podman/i OR CommandLine=/docker run|container create/i)
| (ParentBaseFileName=/act_runner|gitea-runner/i OR CommandLine=/act_runner|GITEA_/i)
| CommandLine=/--privileged|--pid=host|--network=host|--net=host|--userns=host|--ipc=host|--uts=host|--cap-add|CAP_SYS_ADMIN|--device|docker\.sock/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, ImageFileName, CommandLine])
| sort(@timestamp, order=desc)