{"id":"CVE-2026-85469","url":"https://www.cyber-defence.io/tools/cve/CVE-2026-85469","generatedAt":"2026-10-28T08:11:04.555Z","title":"A remote attacker could exploit this by compromising the upstream `Noelware/docker-manifest-action` used in the release workflow, which is pinned to a mutable branch.","description":"A flaw was found in quay-builder-qemu. A remote attacker could exploit this by compromising the upstream `Noelware/docker-manifest-action` used in the release workflow, which is pinned to a mutable branch. This allows the attacker to inject arbitrary code, leading to the exfiltration of sensitive registry credentials or the publication of malicious images. The workflow also exposes the default GitHub token, increasing the severity of the compromise.","published":"2026-09-16T22:18:27.000Z","lastModified":"2026-09-18T19:06:08.000Z","status":"Awaiting Analysis","sourceIdentifier":"secalert@redhat.com","cvss":{"version":"3.1","score":8,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H"},"cwe":["CWE-1357"],"affected":[],"epss":{"score":0.00518,"percentile":0.43834,"date":"2026-10-27","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"high","text":"High impact if exploited, but EPSS currently rates exploitation as unlikely (0.52%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit."},"changes":[],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-85469","source":"secalert@redhat.com"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2528219","source":"secalert@redhat.com"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-85469","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}