CVE-2026-45131
CloudPirates Open Source Helm Charts is a collection of Helm charts. Prior to commit fcf9302, a GitHub Actions workflow (pull-request.yaml) executes attacker-controlled code from fork pull requests in a privileged context, exposing repository secrets including Docker Hub credentials and tokens without requiring maintainer approval. This issue has been patched via commit fcf9302.
View on NVDAnalysis
Esta vulnerabilidad en los Helm Charts de CloudPirates permite a un atacante ejecutar código arbitrario a través de un pull request malicioso en GitHub Actions. El fallo expone secretos críticos del repositorio, como credenciales de Docker Hub y tokens de acceso, facilitando el compromiso total de la cadena de suministro de software. Es indispensable actualizar para proteger los flujos de CI/CD y la infraestructura de despliegue.
Relevant roles
Severity
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:NCWE-94EPSS
No EPSS score yet (CVE may be too fresh).
Technical description
CloudPirates Open Source Helm Charts is a collection of Helm charts. Prior to commit fcf9302, a GitHub Actions workflow (pull-request.yaml) executes attacker-controlled code from fork pull requests in a privileged context, exposing repository secrets including Docker Hub credentials and tokens without requiring maintainer approval. This issue has been patched via commit fcf9302.