CVE-2026-45131

CloudPirates Open Source Helm Charts: GitHub Actions pull_request_target workflow allows secret exfiltration via fork pull requests

View on CVE.org

Published Jun 1, 2026 CVSS 3.1 · 10 Critical EPSS < 1% KEV · Not listed

Description

CloudPirates Open Source Helm Charts is a collection of Helm charts. Prior to commit fcf9302, a GitHub Actions workflow (pull-request.yaml) executes attacker-controlled code from fork pull requests in a privileged context, exposing repository secrets including Docker Hub credentials and tokens without requiring maintainer approval. This issue has been patched via commit fcf9302.

Analysis

Technical impact

The vulnerability allows an attacker submitting a pull request from a forked repository to execute arbitrary code within the pull_request_target workflow, causing the workflow to run in a privileged context. This results in the exposure and exfiltration of repository secrets such as Docker Hub credentials and other tokens. The weakness is identified as CWE‑94, reflecting unsafe code execution.

Affected Systems

The issue affects the CloudPirates‑io helm‑charts repository, specifically all releases or branches of the open‑source Helm charts collection prior to commit fcf9302. No other vendors or products are listed as affected.

Risk and Exploitability

The CVSS score is 10, indicating the highest severity. EPSS is not available and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is a fork pull request that triggers the pull_request_target event; the attacker does not need maintainer approval to cause the workflow to run with repository secrets exposed.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

CloudPirates-io

helm-charts

affected

Version	Status	Constraints
`< fcf930211604652aec15085895b6457bc8b73b54`	affected	—

No data.

Vendor Product Versions

Cloudpirates-io

Helm-charts

Version	Status	Scheme	Platform
`[0,fcf930211604652aec15085895b6457bc8b73b54)`	affected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Update the repository to the patched commit fcf9302, which removes the vulnerable workflow or correctly restricts its execution.
Disable or modify the pull_request_target event so that it only runs for trusted contributors, for example by adding a safeguard that rejects forked pull requests or by switching to the pull_request event that does not run with elevated permissions.
Configure minimal workflow permissions in the repository settings, ensuring that secrets are only exposed to workflows that explicitly require them, and revoke any unused secrets from the repository.
Audit and review the actions and workflow files regularly to detect any privileged executions that are unintended or unnecessary.
Set up alerts for abnormal secret usage or egress so that suspicious exfiltration attempts can be identified and investigated promptly.

Generated by OpenCVE AI on June 1, 2026 at 18:39 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact High

Integrity Impact High

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.275% probability within 30 days)

Exploitation none

Automatable yes

Technical Impact total

References

Link	Providers
https://github.com/CloudPirates-io/helm-charts/commit/fcf930211604652aec15085895b6457bc8b73b54
https://github.com/CloudPirates-io/helm-charts/security/advisories/GHSA-c47r-c7gw-cvph

History

Jun 3, 2026 2:30 AM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Cloudpirates-io Cloudpirates-io helm-charts
Vendors & Products		Cloudpirates-io Cloudpirates-io helm-charts

Jun 1, 2026 9:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Jun 1, 2026 5:00 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		CloudPirates Open Source Helm Charts is a collection of Helm charts. Prior to commit fcf9302, a GitHub Actions workflow (pull-request.yaml) executes attacker-controlled code from fork pull requests in a privileged context, exposing repository secrets including Docker Hub credentials and tokens without requiring maintainer approval. This issue has been patched via commit fcf9302.
Title		CloudPirates Open Source Helm Charts: GitHub Actions pull_request_target workflow allows secret exfiltration via fork pull requests
Weaknesses		CWE-94
References		https://github.com/CloudPirates-io/helm-charts/commit/fcf930211604652aec15085895b6457bc8b73b54 https://github.com/CloudPirates-io/helm-charts/security/advisories/GHSA-c47r-c7gw-cvph
Metrics		cvssV3_1 `{'score': 10, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N'}`