Cache Poisoning and OIDC Token Theft in CloudPirates Open Source Helm Charts
CVE-2026-54532

6.9MEDIUM

Key Information:

Vendor

Cloudpirates-io

Status
Helm-charts
Vendor
CVE Published:
22 October 2026

What is CVE-2026-54532?

CloudPirates Open Source Helm Charts previously had a vulnerability within its pull_request_target workflow. Prior to the patch in commit 271d415, this workflow allowed potential attackers access to secrets and tokens stored in the base repository by processing malicious forked code. The vulnerability enabled attackers to poison the shared Actions cache, leading to unauthorized code execution during release processes or publication workflows. This risk was mitigated by recent updates to their security measures.

Affected Version(s)

helm-charts < 271d415975a64b7958d2740526dca870b70c8c21

References

https://github.com/CloudPirates-io/helm-charts/security/a...
x_refsource_CONFIRM
https://github.com/CloudPirates-io/helm-charts/commit/271...
x_refsource_MISC

CVSS V3.1

Score:
6.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.