Vulnerability · Published Oct 22, 2026 · Assigned by GitHub_M

CVE-2026-54532CloudPirates Open Source Helm Charts: pull_request_target workflow vulnerable to cache poisoning and OIDC token theft

Medium 6.9

In plain English

A medium-severity security flaw in helm-charts from CloudPirates-io. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 8% of all known vulnerabilities).

Severity (CVSS 3.1)6.9Medium

Exploit odds (30 days)0.2%top 91.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

CloudPirates Open Source Helm Charts is a collection of Helm charts. Prior to commit 271d415, pull_request_target workflow is vulnerable to cache poisoning and OIDC token theft. A pull_request_target workflow checks out fork code using github.event.pull_request.head.sha or .head.ref. This gives attacker-controlled code access to base repository secrets and tokens. A pull_request_target workflow writes to a shared Actions cache. A subsequent release or publish workflow restores from the same cache scope, allowing a poisoned cache entry to execute during release. This issue has been patched via commit 271d415.

Affected products (as reported)

Vendor	Product	Versions
CloudPirates-io	helm-charts	< 271d415975a64b7958d2740526dca870b70c8c21

Weakness: CWE-829 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:N/I:H/A:L

References

https://github.com/CloudPirates-io/helm-charts/security/advisories/GHSA-gv8x-4mc5-r65r x_refsource_CONFIRM
https://github.com/CloudPirates-io/helm-charts/commit/271d415975a64b7958d2740526dca870b70c8c21 x_refsource_MISC