CVE-2026-45132
CloudPirates Open Source Helm Charts is a collection of Helm charts. Prior to commit fcf9302, a GitHub Actions workflow (generate-schema.yaml) exposes sensitive credentials (Personal Access Token and SSH signing key) to fork-controlled code due to unsafe checkout and credential handling practices. This issue has been patched via commit fcf9302.
Ver en NVDAnálisis
Esta vulnerabilidad de severidad maxima en los Helm charts de CloudPirates permite la filtracion de credenciales sensibles como tokens de acceso personal y llaves SSH mediante GitHub Actions. Un atacante podria comprometer la infraestructura de CI/CD ejecutando codigo malicioso desde un fork para extraer secretos de despliegue en entornos de Kubernetes. Es fundamental actualizar a la version corregida para proteger los secretos y la integridad del pipeline.
Roles relevantes
Severidad
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:NCWE-94EPSS
Sin puntaje EPSS aún (CVE muy reciente).
Descripción técnica
CloudPirates Open Source Helm Charts is a collection of Helm charts. Prior to commit fcf9302, a GitHub Actions workflow (generate-schema.yaml) exposes sensitive credentials (Personal Access Token and SSH signing key) to fork-controlled code due to unsafe checkout and credential handling practices. This issue has been patched via commit fcf9302.