CVE-2026-54532— CloudPirates Open Source Helm Charts: pull_request_target workflow vulnerable to cache poisoning and OIDC token theft
Quick assessment
Affected
CloudPirates-io helm-charts
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
CloudPirates 开源 Helm Charts 是一组 Helm 图表。在提交 271d415 之前，其 工作流存在缓存投毒和 OIDC 令牌窃取漏洞。该工作流通过 或 检出分支代码，导致攻击者控制的代码能够访问基础仓库的密钥和令牌。此外，该工作流会向共享的 Actions 缓存写入数据；后续的发布或发布工作流会从同一缓存作用域恢复数据，使得被投毒的缓存条目在发布过程中被执行。此问题已通过提交 271d415 修复。
Possible ATT&CK Techniques 3 AI
T1560 · Archive Collected Data T1078 · Valid Accounts T1538 · Cloud Service DashboardAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| CloudPirates-io | helm-charts | < 271d415975a64b7958d2740526dca870b70c8c21 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-54532
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
CloudPirates Open Source Helm Charts: pull_request_target workflow vulnerable to cache poisoning and OIDC token theft
Source: CVE Program / CVE List V5
Vulnerability Description
CloudPirates Open Source Helm Charts is a collection of Helm charts. Prior to commit 271d415, pull_request_target workflow is vulnerable to cache poisoning and OIDC token theft. A pull_request_target workflow checks out fork code using github.event.pull_request.head.sha or .head.ref. This gives attacker-controlled code access to base repository secrets and tokens. A pull_request_target workflow writes to a shared Actions cache. A subsequent release or publish workflow restores from the same cache scope, allowing a poisoned cache entry to execute during release. This issue has been patched via commit 271d415.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:N/I:H/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
从非可信控制范围包含功能例程
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| CloudPirates-io | helm-charts | < 271d415975a64b7958d2740526dca870b70c8c21 | - |
|
II. Public POCs for CVE-2026-54532
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-54532
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-54532 (1)
Vendor Advisories for CVE-2026-54532 (1)
IV. Related Vulnerabilities
V. Comments for CVE-2026-54532
No comments yet