Vulnerability · Published Sep 16, 2026 · Assigned by redhat

CVE-2026-85469Quay-builder-qemu: quay-builder-qemu: release workflow uses third-party action pinned to mutable @master with registry credentials in scope

High 8.0

In plain English

A high-severity security flaw in Red Hat Quay 3 from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 44% of all known vulnerabilities).

Severity (CVSS 3.1)8.0High

Exploit odds (30 days)0.5%top 55.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A flaw was found in quay-builder-qemu. A remote attacker could exploit this by compromising the upstream `Noelware/docker-manifest-action` used in the release workflow, which is pinned to a mutable branch. This allows the attacker to inject arbitrary code, leading to the exfiltration of sensitive registry credentials or the publication of malicious images. The workflow also exposes the default GitHub token, increasing the severity of the compromise.

Affected products (as reported)

Vendor	Product	Versions
Red Hat	Red Hat Quay 3	see references

Weakness: CWE-1357 · Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

References

https://access.redhat.com/security/cve/CVE-2026-85469 vdb-entry, x_refsource_REDHAT
RHBZ#2528219 issue-tracking, x_refsource_REDHAT