CVE-2026-85469

quay-builder-qemu contains a flaw in its release workflow, where the third-party GitHub Action Noelware/docker-manifest-action is pinned to a mutable @master branch . Because the reference is not fixed to a specific commit, a remote attacker who compromises the upstream action repository can inje...