CVE-2026-85469
Quay-builder-qemu: quay-builder-qemu: release workflow uses third-party action pinned to mutable @master with registry credentials in scope
- State
- Published
- Severity
- 8.0 High
- Published
- Sep 16, 2026
- Updated
- Oct 7, 2026
- Reserved
- Sep 3, 2026
Description
A flaw was found in quay-builder-qemu. A remote attacker could exploit this by compromising the upstream `Noelware/docker-manifest-action` used in the release workflow, which is pinned to a mutable branch. This allows the attacker to inject arbitrary code, leading to the exfiltration of sensitive registry credentials or the publication of malicious images. The workflow also exposes the default GitHub token, increasing the severity of the compromise.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 8.0 High | CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H | redhat |
Weaknesses
- CWE-1357 Reliance on Insufficiently Trustworthy Component
Affected Products
| Product | Versions |
|---|---|
Red Hat Quay 3Red Hat |
References
- https://access.redhat.com/security/cve/CVE-2026-85469vdb-entry
- RHBZ#2528219issue-tracking
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.