What’s Vulnerable › Vulnerabilities

CVE-2026-85469: Quay-builder-qemu: quay-builder-qemu: release workflow uses third-party action pinned to mutable @master with registry credentials in scope

• Severity: high (CVSS 8.0 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-16 · updated 2026-09-18
• Weakness: CWE-1357

Description

A flaw was found in quay-builder-qemu. A remote attacker could exploit this by compromising the upstream `Noelware/docker-manifest-action` used in the release workflow, which is pinned to a mutable branch. This allows the attacker to inject arbitrary code, leading to the exfiltration of sensitive registry credentials or the publication of malicious images. The workflow also exposes the default GitHub token, increasing the severity of the compromise.

Affected products

• Red Hat Quay 3: all versions

References

• https://access.redhat.com/security/cve/CVE-2026-85469
• https://bugzilla.redhat.com/show_bug.cgi?id=2528219

Get alerted when CVE-2026-85469 or the next vulnerability affects your stack