CVE-2026-45131
CloudPirates Open Source Helm Charts is a collection of Helm charts. Prior to commit fcf9302, a GitHub Actions workflow (pull-request.yaml) executes attacker-controlled code from fork pull requests in a privileged context, exposing repository secrets including Docker Hub credentials and tokens without requiring maintainer approval. This issue has been patched via commit fcf9302.
Ver en NVDAnálisis
Esta vulnerabilidad en los Helm Charts de CloudPirates permite a un atacante ejecutar código arbitrario a través de un pull request malicioso en GitHub Actions. El fallo expone secretos críticos del repositorio, como credenciales de Docker Hub y tokens de acceso, facilitando el compromiso total de la cadena de suministro de software. Es indispensable actualizar para proteger los flujos de CI/CD y la infraestructura de despliegue.
Roles relevantes
Severidad
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:NCWE-94EPSS
Sin puntaje EPSS aún (CVE muy reciente).
Descripción técnica
CloudPirates Open Source Helm Charts is a collection of Helm charts. Prior to commit fcf9302, a GitHub Actions workflow (pull-request.yaml) executes attacker-controlled code from fork pull requests in a privileged context, exposing repository secrets including Docker Hub credentials and tokens without requiring maintainer approval. This issue has been patched via commit fcf9302.