{"id":"CVE-2026-54532","aliases":[],"cve":{"records":[{"id":"CVE-2026-54532","source":"GitHub_M","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-06-15T18:40:01.651Z","published":"2026-10-22T17:16:38.540Z","modified":"2026-10-30T19:47:13.018Z"}],"publishers":[{"name":"GitHub_M","role":"CNA","organizationId":"a0819718-46f1-4df5-94e2-005712e83aaa","modified":"2026-10-22T17:16:38.540Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-10-30T19:47:13.018Z"}],"references":[{"url":"https://github.com/CloudPirates-io/helm-charts/security/advisories/GHSA-gv8x-4mc5-r65r","tags":["x_refsource_CONFIRM"],"source":"GitHub_M"},{"url":"https://github.com/CloudPirates-io/helm-charts/commit/271d415975a64b7958d2740526dca870b70c8c21","tags":["x_refsource_MISC"],"source":"GitHub_M"}],"weaknesses":[{"id":"CWE-829","description":"CWE-829: Inclusion of Functionality from Untrusted Control Sphere","source":"GitHub_M"}],"applicability":[],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-10-30T19:47:03.478531Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"no"},{"name":"Technical Impact","value":"partial"}]}]},"title":"CloudPirates Open Source Helm Charts: pull_request_target workflow vulnerable to cache poisoning and OIDC token theft","titleSource":"GitHub_M","descriptionSource":"GitHub_M","description":"CloudPirates Open Source Helm Charts is a collection of Helm charts. Prior to commit 271d415, pull_request_target workflow is vulnerable to cache poisoning and OIDC token theft. A pull_request_target workflow checks out fork code using github.event.pull_request.head.sha or .head.ref. This gives attacker-controlled code access to base repository secrets and tokens. A pull_request_target workflow writes to a shared Actions cache. A subsequent release or publish workflow restores from the same cache scope, allowing a poisoned cache entry to execute during release. This issue has been patched via commit 271d415.","score":6.9,"severity":"medium","published":"2026-10-22T17:16:38.540Z","modified":"2026-10-30T19:47:13.018Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"CloudPirates-io","name":"helm-charts","platforms":[],"versions":[{"version":"< 271d415975a64b7958d2740526dca870b70c8c21","status":"affected"}],"cpes":[],"source":"GitHub_M","url":"https://www.cve.org/CVERecord?id=CVE-2026-54532"}],"remediation":[],"references":["https://github.com/CloudPirates-io/helm-charts/security/advisories/GHSA-gv8x-4mc5-r65r","https://github.com/CloudPirates-io/helm-charts/commit/271d415975a64b7958d2740526dca870b70c8c21"],"sources":[{"name":"CVE","id":"CVE-2026-54532","modified":"2026-10-30T19:47:13.018Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-54532"}],"assessments":[{"source":"GitHub_M","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:N/I:H/A:L","score":6.9}],"sourceAffected":[],"observedAt":"2026-10-30T21:05:34.590Z","kev":{"status":"not-listed","checkedAt":"2026-10-31T16:20:31.233Z"},"coverage":[{"source":"NVD","status":"not-checked"},{"source":"GHSA","status":"not-checked"},{"source":"EUVD","status":"not-checked"},{"source":"EPSS","status":"not-checked"}],"evidence":[],"aiSummary":{"text":"CloudPirates Open Source Helm Charts versions prior to commit 271d415 are vulnerable to cache poisoning and OIDC token theft via the pull_request_target workflow, allowing attacker-controlled code access to base repository secrets and tokens. The weakness is due to the inclusion of functionality from an untrusted control sphere. This issue has been patched via commit 271d415.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-10-31T05:21:15.199Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-54532"}]}}