CloudPirates Open Source Helm Charts relies on GitHub Actions pull_request_target workflows that check out code from a pull request head using the event payload. Prior to the fix, an attacker could submit a malicious pull request from a fork, inject code that accesses the base repository’s secrets and OIDC tokens, and write a corrupted entry into the shared Actions cache. When a subsequent release or publish workflow restores from that same cache scope, the poisoned data can be executed, allowing the attacker to read or exfiltrate secrets, gain code‑execution privilege in the CI environment, and potentially compromise artifacts produced by the repo.

The vulnerable implementation resides in the CloudPirates‑io helm‑charts collection. All chart releases before commit 271d415 are affected. No specific vendor version numbers are listed, so organizations should verify that their deployed chart includes the commit that patches the issue. The vulnerability applies to any repository that incorporates or forks the charts into its GitHub Actions workflows.

The CVSS base score of 6.9 indicates medium severity and the EPSS score is not available, implying no public exploitation data. The vulnerability is not listed in CISA’s KEV catalog. Attackers only need to create a forged pull request in a forked repository; no privileged access beyond contributing a PR is required. Because the exploit relies on standard pull_request_target behavior, CI runners with default permissions can be affected, making the risk real for projects using these charts without additional safeguards.