8.0
High
CVE-2026-85469 A flaw was found in quay-builder-qemu
Description
A flaw was found in quay-builder-qemu. A remote attacker could exploit this by compromising the upstream `Noelware/docker-manifest-action` used in the release workflow, which is pinned to a mutable branch. This allows the attacker to inject arbitrary code, leading to the exfiltration of sensitive registry credentials or the publication of malicious images. The workflow also exposes the default GitHub token, increasing the severity of the compromise.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Red Hat Quay 3 | Versions not published |
Other CVEs of Red Hat Quay 3
The 117 CVEs of Red Hat Quay 3 →
CVE-2026-114406
Ca-certificates: distrust emudhra intermediate ca certificates due to security concerns
6.8
Medium
CVE-2026-114236
Podman: goroutine/file-descriptor leak in storage/pkg/archive.applylayer and applyuncompressedlayer on malformed layers
3.3
Low
CVE-2026-85471
A flaw was found in Quay
6.4
Medium
CVE-2026-109194
A flaw was found in Red Hat Quay
6.4
Medium