CVE-2026-85469
Quay-builder-qemu: quay-builder-qemu: release workflow uses third-party action pinned to mutable @master with registry credentials in scope
CVSS Score
8.0
EPSS Score
0.0%
EPSS Percentile
0th
A flaw was found in quay-builder-qemu. A remote attacker could exploit this by compromising the upstream `Noelware/docker-manifest-action` used in the release workflow, which is pinned to a mutable branch. This allows the attacker to inject arbitrary code, leading to the exfiltration of sensitive registry credentials or the publication of malicious images. The workflow also exposes the default GitHub token, increasing the severity of the compromise.
| CWE | CWE-1357 |
| Vendor | red hat |
| Product | red hat quay 3 |
| Published | Sep 16, 2026 |
| Last Updated | Sep 16, 2026 |
Stay Ahead of the Next One
Get instant alerts for red hat red hat quay 3
Be the first to know when new high vulnerabilities affecting red hat red hat quay 3 are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H Attack Vector
Network
Attack Complexity
High
Privileges Required
High
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
High
Availability
High
Affected Versions
Red Hat / Red Hat Quay 3
All versions affected