The quay-builder-qemu component in Red Hat Quay uses a release workflow that incorporates the third-party GitHub Action Noelware/docker-manifest-action pinned to a mutable branch (@master). This introduces a supply chain vulnerability where a remote attacker can compromise the upstream action to inject arbitrary code. Such code injection can result in exfiltration of sensitive registry credentials (including Quay push tokens) or the publication of malicious container images, undermining the integrity of images consumed by Red Hat Quay build executors. Additionally, the workflow exposes the default GitHub token, further increasing the risk. Red Hat has classified this as an important supply chain vulnerability with a high CVSS v3.1 score of 8.0, reflecting high impact on confidentiality, integrity, and availability. Currently, no mitigation or patch is available that meets Red Hat's standards for ease of use, applicability, or stability.

Successful exploitation allows remote attackers to execute arbitrary code within the build workflow, leading to exfiltration of sensitive registry credentials and the potential publication of malicious container images. This compromises the integrity and confidentiality of container images built and distributed via Red Hat Quay, potentially affecting downstream consumers. The exposure of the default GitHub token further elevates the risk by enabling broader unauthorized access within the GitHub environment.

As per the Red Hat advisory, no mitigation or patch currently meets the criteria for deployment. Users should monitor Red Hat advisories for updates. Until a fix or effective mitigation is available, organizations should consider restricting access to the affected workflows and carefully review the use of third-party GitHub Actions pinned to mutable branches in their CI/CD pipelines.