CVE-2026-54532

The record

CloudPirates Open Source Helm Charts is a collection of Helm charts. Prior to commit 271d415, pull_request_target workflow is vulnerable to cache poisoning and OIDC token theft. A pull_request_target workflow checks out fork code using github.event.pull_request.head.sha or .head.ref. This gives attacker-controlled code access to base repository secrets and tokens. A pull_request_target workflow writes to a shared Actions cache. A subsequent release or publish workflow restores from the same cache scope, allowing a poisoned cache entry to execute during release. This issue has been patched via commit 271d415.

Affected packages

Related vulnerabilities

• CVE-2026-63184 Refitter is a tool for generating a C# REST API client using the Refit library. CWE-829
• CVE-2026-118762 Monkeytype is a minimalistic and customizable typing test. CWE-829
• CVE-2023-7357 A remote code execution (RCE) vulnerability was identified in the FlexNet Publisher… CWE-829
• CVE-2026-15564 Wildfly's IIOP listener may permit deserialization of input streams before authentication… CWE-829
• CVE-2026-114488 A flaw was found in Wildfly. CWE-829
• CVE-2026-84725 when EAP runs with -secmgr, the openjdk-orb's JDKBridge honours attacker-supplied CDR… CWE-829
• CVE-2026-59172 Joker is a small Clojure interpreter, linter and formatter written in Go. CWE-829
• CVE-2026-59176 Functype is a family of TypeScript functional programming libraries. CWE-829