CyberRota Analysis
AI-GeneratedA vulnerability in quay-builder-qemu affects GitHub and Docker, enabling remote attackers to exploit the mutable branch of the `Noelware/docker-manifest-action` in the release workflow. This flaw allows for arbitrary code injection, potentially leading to the exfiltration of sensitive registry credentials and the publication of malicious images, while also exposing the default GitHub token. Organizations utilizing these platforms should prioritize remediation to mitigate the risk of credential theft and malicious activity.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
A flaw was found in quay-builder-qemu. A remote attacker could exploit this by compromising the upstream `Noelware/docker-manifest-action` used in the release workflow, which is pinned to a mutable branch. This allows the attacker to inject arbitrary code, leading to the exfiltration of sensitive registry credentials or the publication of malicious images. The workflow also exposes the default GitHub token, increasing the severity of the compromise.