CVE-2026-45131
CloudPirates Open Source Helm Charts had a critical vulnerability that allowed attackers to run arbitrary code in a privileged GitHub Actions workflow when merging pull requests from forks. The flaw exposed repository secrets such as Docker Hub credentials. The issue was fixed by commit fcf9302.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
CloudPirates Open Source Helm Charts (any version before commit fcf9302).
Real-world impact
An attacker could execute arbitrary code with repository secrets, potentially leaking credentials and compromising downstream deployments.
Why this severity
The CVSS score of 10 reflects that the vulnerability is exploitable over the network with no authentication, provides complete confidentiality and integrity compromise, and is user interface independent.
What to do about it
- 01Update the CloudPirates Open Source Helm Charts repository to a version that includes commit fcf9302 or later.
- 02Verify that the pull-request.yaml workflow no longer executes attacker‑controlled code.
- 03(Optional) Restart any services that rely on the updated charts to ensure the fix takes effect.
NVD description
Timeline
- Jun 1, 2026 · Jun 1, 2026PublishedDisclosed and added to the National Vulnerability Database.
- Jul 22, 2026 · 13d agoAdvisory updatedThe NVD record was last revised.
- Jul 25, 2026 · 10d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.