CVE-2026-85469 — Quay-builder-qemu: quay-builder-qemu: release workflow uses third-party action pinned to mutable @master with registr…

CVE-2026-85469

Quay-builder-qemu: quay-builder-qemu: release workflow uses third-party action pinned to mutable @master with registry credentials in scope PUBLISHED

Description (CNA)

A flaw was found in quay-builder-qemu. A remote attacker could exploit this by compromising the upstream `Noelware/docker-manifest-action` used in the release workflow, which is pinned to a mutable branch. This allows the attacker to inject arbitrary code, leading to the exfiltration of sensitive registry credentials or the publication of malicious images. The workflow also exposes the default GitHub token, increasing the severity of the compromise.

Affected (CNA)

Vendor / product	Versions
Red Hat / Red Hat Quay 3	affected

CWE

CWE-1357

References

https://access.redhat.com/security/cve/CVE-2026-85469
https://bugzilla.redhat.com/show_bug.cgi?id=2528219

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.