CVE-2026-85469

CVE-2026-85469 is a CI/CD supply-chain weakness (CWE-1357) in the release workflow for quay-builder-qemu, the QEMU-based build image used by Red Hat Quay / Project Quay's container build feature. The workflow invokes the third-party GitHub Action Noelware/docker-manifest-action pinned to a mutable branch instead of an immutable commit, so an attacker who compromises that upstream action can inject arbitrary code into the release workflow. With code execution in the workflow, the attacker can exfiltrate the registry credentials used to publish quay-builder-qemu images, publish trojanized images to downstream users, and abuse the exposed default GITHUB_TOKEN to further tamper with the repository. Affected parties are organizations that pull or run quay-builder-qemu images as part of Quay's builder feature; the CVSS vector (AV:N/AC:H/PR:H/S:C) reflects that exploitation requires first compromising the upstream action but then crosses trust boundaries. No public proof-of-concept, CISA KEV listing, or confirmed in-the-wild exploitation is known.

What to do: Pin Noelware/docker-manifest-action (and all workflow actions) to a full-length immutable commit SHA, set GITHUB_TOKEN permissions to the minimum required, and rotate any registry credentials accessible to the release workflow. Verify the digests/signatures of quay-builder-qemu images currently in use and monitor Red Hat / Project Quay security advisories for updated builder images, as no fixed version is identified in the available data.