Live › vulnerability › CVE-2026-54532
Go to dashboardThe CI workflows in the CloudPirates Open Source Helm Charts repository ran fork pull request code with access to base repository secrets and wrote to a shared Actions cache. A later release workflow restored that cache, so a poisoned entry could run during a release and expose OIDC tokens.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams that consume or fork the CloudPirates Open Source Helm Charts repository and run its CI or release workflows. Users who only install published charts from a registry and do not build from this repository are unlikely to be affected, but the sources do not say this explicitly.
No product ranges from the sources yet.
271d415 or laterpull_request_target workflows for checkout of github.event.pull_request.head.sha or .head.ref followed by cache writes271d415, which the sources say patches the issueEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
CloudPirates Open Source Helm Charts is a collection of Helm charts. Prior to commit 271d415, pull_request_target workflow is vulnerable to cache poisoning and OIDC token theft. A pull_request_target workflow checks out fork code using github.event.pull_request.head.sha or .head.ref. This gives attacker-controlled code access to base repository secrets and tokens. A pull_request_target workflow writes to a shared Actions cache. A subsequent release or publish workflow restores from the same cache scope, allowing a poisoned cache entry to execute during release. This issue has been patched via commit 271d415.
This page as .md · .json · in your agent: get_signal("CVE-2026-54532")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.