CVE-2026-85469

Name of the Vulnerable Software and Affected Versions quay-builder-qemu (affected versions not specified)

Description A flaw exists where the release workflow uses the upstream Noelware/docker-manifest-action pinned to a mutable branch. A remote attacker could compromise this upstream action to inject arbitrary code into the workflow. Since the action executes after registry authentication, this could lead to the exfiltration of sensitive registry credentials or the publication of malicious images. Additionally, the workflow exposes the default GitHub token, which increases the potential impact of the compromise.

Recommendations Replace third-party Actions referenced by branches or movable tags with full commit hashes. Implement explicit GitHub Actions permissions: blocks to restrict job capabilities to only what is required. Review registry push history, image digests, and release timestamps for unauthorized changes. Restrict the use of the Noelware/docker-manifest-action until it is pinned to a specific commit hash.