CVE-2026-45131: CloudPirates Open Source Helm Charts: GitHub Actions pull_request_target workflow allows secret exfiltration via fork pull requests
CloudPirates Open Source Helm Charts is a collection of Helm charts. Prior to commit fcf9302, a GitHub Actions workflow (pull-request.yaml) executes attacker-controlled code from fork pull requests in a privileged context, exposing repository secrets including Docker Hub credentials and tokens without requiring maintainer approval. This issue has been patched via commit fcf9302.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
CloudPirates Open Source Helm Charts (GitHub Actions workflow pull-request.yaml)to a version that resolves this vulnerability.Patch fcf9302
Event History
Frequently Asked Questions
What is the severity of CVE-2026-45131?
CVE-2026-45131 has a critical severity rating of 10.
How do I fix CVE-2026-45131?
To fix CVE-2026-45131, ensure that the pull_request_target workflow does not execute untrusted code from fork pull requests.
What type of vulnerability is CVE-2026-45131?
CVE-2026-45131 is classified as a code injection vulnerability.
What can be exposed due to CVE-2026-45131?
CVE-2026-45131 allows for the exfiltration of repository secrets, including Docker Hub credentials and tokens.
Which software is affected by CVE-2026-45131?
CVE-2026-45131 affects the CloudPirates Open Source Helm Charts.