Vulnerability · Published Jun 1, 2026 · Assigned by GitHub_M

CVE-2026-45131CloudPirates Open Source Helm Charts: GitHub Actions pull_request_target workflow allows secret exfiltration via fork pull requests

Critical 10.0

In plain English

A critical-severity code injection in helm-charts from CloudPirates-io. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 20% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.

Severity (CVSS 3.1)10.0Critical

Exploit odds (30 days)0.3%top 80.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack tooling1Public PoC

Official description

CloudPirates Open Source Helm Charts is a collection of Helm charts. Prior to commit fcf9302, a GitHub Actions workflow (pull-request.yaml) executes attacker-controlled code from fork pull requests in a privileged context, exposing repository secrets including Docker Hub credentials and tokens without requiring maintainer approval. This issue has been patched via commit fcf9302.

Affected products (as reported)

Vendor	Product	Versions
CloudPirates-io	helm-charts	< fcf930211604652aec15085895b6457bc8b73b54

Weakness: CWE-94 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

References

https://github.com/CloudPirates-io/helm-charts/security/advisories/GHSA-c47r-c7gw-cvph x_refsource_CONFIRM
https://github.com/CloudPirates-io/helm-charts/commit/fcf930211604652aec15085895b6457bc8b73b54 x_refsource_MISC