Executive brief
quay-builder-qemu is a component used by Red Hat Quay to build container images. The release workflow uses a third-party GitHub Action pinned to a mutable branch that could be modified by an attacker, allowing them to inject malicious code. If exploited, attackers could steal container registry credentials, publish malicious container images, or compromise the integrity of the build process, putting all images built with this system at risk.
Technical details
This vulnerability is a supply chain attack (CWE-1357) stemming from reliance on an insufficiently trustworthy third-party component. The quay-builder-qemu release workflow uses the Noelware/docker-manifest-action GitHub Action pinned to a mutable @master branch rather than a specific immutable commit or tag. An attacker who gains control of the upstream action repository can inject arbitrary code that executes with elevated privileges during the build workflow. The workflow exposes the default GitHub token and has container registry credentials in scope, enabling attackers to exfiltrate Quay push tokens or publish trojaned container images. Red Hat has not released a mitigation or fix, indicating this is a security issue in the build infrastructure itself.
Affected products
- Red Hat quay-builder-qemu
Timeline
- 2026-09-16: disclosed