RCE in Quay Builder QEMU via Mutable GitHub Action
CVE-2026-85469 Published on September 16, 2026
Quay-builder-qemu: quay-builder-qemu: release workflow uses third-party action pinned to mutable @master with registry credentials in scope
A flaw was found in quay-builder-qemu. A remote attacker could exploit this by compromising the upstream `Noelware/docker-manifest-action` used in the release workflow, which is pinned to a mutable branch. This allows the attacker to inject arbitrary code, leading to the exfiltration of sensitive registry credentials or the publication of malicious images. The workflow also exposes the default GitHub token, increasing the severity of the compromise.
Vulnerability Analysis
CVE-2026-85469 can be exploited with network access, and requires user privileges. This vulnerability is consided to have a high level of attack complexity. The potential impact of an exploit of this vulnerability is considered to be very high.
Timeline
Reported to Red Hat.
Made public. 13 days later.
Weakness Type
Products Associated with CVE-2026-85469
Want to know whenever a new CVE is published for Red Hat Quay? stack.watch will email you.
