CloudPirates-io's Helm charts contained a vulnerability (CVE-2026-45131) where a GitHub Actions workflow (pull-request.yaml) ran code from fork pull requests in a privileged context. This allowed attackers to execute arbitrary code and access repository secrets including Docker Hub credentials and tokens without maintainer approval. The issue was fixed by commit fcf9302, which prevents execution of untrusted code in this context. The vulnerability is classified as CWE-94 (Improper Control of Generation of Code) and has a CVSS 3.1 base score of 10.0, reflecting its critical impact and ease of exploitation.

An attacker can execute arbitrary code in the context of the GitHub Actions workflow without requiring maintainer approval, leading to exposure of sensitive repository secrets such as Docker Hub credentials and tokens. This compromises confidentiality and integrity of the repository environment. The vulnerability does not affect availability. No known exploits in the wild have been reported at this time.

This vulnerability has been patched by commit fcf9302 in the CloudPirates-io helm-charts repository. Users should update to the fixed version at or beyond this commit to remediate the issue. Since this is not a cloud service, remediation requires applying the patch to the affected codebase. Patch status is confirmed by the vendor commit reference. No additional mitigation steps are indicated.