PT-2026-45467 · Cloudpirates Io · Cloudpirates Open Source Helm Charts

Avivdon · Published 2026-06-01 · Updated 2026-06-12 · CVE-2026-45131

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions CloudPirates Open Source Helm Charts versions prior to commit fcf9302

Description A GitHub Actions workflow in the pull-request.yaml file executes attacker-controlled code from fork pull requests within a privileged context. This allows for the exfiltration of repository secrets, such as Docker Hub credentials and tokens, without requiring approval from a maintainer.

Recommendations Update to the version containing commit fcf9302.

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2026-45131

Affected Products

Cloudpirates Open Source Helm Charts

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-45131 · Security Note
• https://github.com/CloudPirates-io/helm-charts/commit/fcf930211604652aec15085895b6457bc8b73b54 · Note
• https://github.com/CloudPirates-io/helm-charts/security/advisories/GHSA-c47r-c7gw-cvph · Note
• https://twitter.com/HugoValters/status/2063692215000477802 · Twitter Post
• https://twitter.com/KaitanSecurity/status/2065452880924901684 · Twitter Post
• https://t.me/CVEtracker/55503 · Telegram Post