CVE-2026-54532 Details

A vulnerability has been identified in CloudPirates Open Source Helm Charts, specifically within the GitHub Actions workflows. Prior to commit 271d415, the 'pull_request_target' workflow was susceptible to cache poisoning and OpenID Connect (OIDC) token theft. This vulnerability arises because the 'pull_request_target' workflow checks out code from forks using 'github.event.pull_request.head.sha' or '.head.ref', granting attacker-controlled code access to base repository secrets and tokens. Additionally, the 'pull_request_target' workflow writes to a shared Actions cache, which can be exploited by a subsequent release or publish workflow that restores from the same cache scope, allowing a poisoned cache entry to execute during the release process.

The vulnerability has been patched in commit 271d415. To address this issue, remove the 'pull_request_target' workflow cache and ensure that fork-triggered workflows do not write to cache scopes shared with release workflows. Instead, use separate cache key namespaces or disable cache writes on 'pull_request_target' jobs.