detail
This is not a subtle bug, and it is not new. It is on this list because we have now found it in eleven separate estates in two years, always in the same shape: a runner set up quickly for one trusted team, then opened to the wider organisation without revisiting the isolation model.
A pipeline in any repository could reach the host socket, start a privileged container, and read the secrets injected into every other pipeline on that runner. In three of the eleven cases this included production deployment credentials.
The fix is isolation per trust boundary rather than per team. We have published the runner configuration we recommend, along with a detection rule that fires on socket access from within a build container.
