Threat database

CVE-2026-54532 affects CloudPirates Open Source Helm Charts, where a pull_request_target GitHub Actions workflow was vulnerable to cache poisoning and OIDC token theft. The workflow checked out forked code using untrusted references, allowing attacker-controlled code to access repository secrets and tokens. The shared Actions cache could be poisoned by this workflow, enabling malicious code execution in subsequent release or publish workflows. This vulnerability has been patched in commit 271d415.

CVE-2026-45131 is a critical code injection vulnerability in CloudPirates-io's open source Helm charts. Before a specific commit (fcf9302), a GitHub Actions workflow executed attacker-controlled code from forked pull requests with privileged access, exposing sensitive repository secrets such as Docker Hub credentials and tokens without requiring maintainer approval. This vulnerability has been patched in commit fcf9302. The CVSS score is 10.0, indicating a critical severity with network attack vector, no privileges or user interaction required, and complete confidentiality and integrity impact. No known exploits in the wild have been reported.

CVE-2026-45132 is a critical vulnerability in CloudPirates-io's open source Helm charts. The issue involves a GitHub Actions workflow (generate-schema.yaml) that, prior to a specific commit, exposed sensitive credentials such as a Personal Access Token and SSH signing key to code controlled by forks. This exposure was due to unsafe checkout and credential handling practices, leading to improper control of code generation (CWE-94). The vulnerability has been patched in commit fcf9302. The CVSS score is 10.0, indicating a critical severity with network attack vector, no privileges required, no user interaction, and high confidentiality and integrity impact. No known exploits in the wild have been reported. The product is not a cloud service, and patch status is not explicitly confirmed beyond the mention of the patch commit.