{"schema":"threatline.record/2","record":{"id":"CVE-2026-54532","aliases":["GHSA-gv8x-4mc5-r65r"],"summary":"CloudPirates Open Source Helm Charts: pull_request_target workflow vulnerable to cache poisoning and OIDC token theft","details":"CloudPirates Open Source Helm Charts is a collection of Helm charts. Prior to commit 271d415, pull_request_target workflow is vulnerable to cache poisoning and OIDC token theft. A pull_request_target workflow checks out fork code using github.event.pull_request.head.sha or .head.ref. This gives attacker-controlled code access to base repository secrets and tokens. A pull_request_target workflow writes to a shared Actions cache. A subsequent release or publish workflow restores from the same cache scope, allowing a poisoned cache entry to execute during release. This issue has been patched via commit 271d415.","categories":["Unclassified"],"product":"helm-charts","vendor":"CloudPirates-io","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-54532","source_modified_at":"2026-10-22T17:16:38.540Z","fetched_at":"2026-10-23T18:42:43.628194Z","product":"helm-charts","vendor":"CloudPirates-io","versions":[{"status":"affected","version":"< 271d415975a64b7958d2740526dca870b70c8c21"}],"defaultStatus":null},{"source":"GitHub Advisory Database","source_url":"https://github.com/CloudPirates-io/helm-charts/security/advisories/GHSA-gv8x-4mc5-r65r","source_modified_at":"2026-06-15T19:29:19Z","fetched_at":"2026-10-24T05:41:33.294140Z","package":{"ecosystem":"actions","name":"CloudPirates-io/helm-charts"},"range":"None"}],"fixed_versions":[],"cvss":6.9,"severity":"Medium","kev":{"listed":false},"epss":{"probability":0.00187,"percentile":0.07882,"score_date":"2026-10-23"},"published_at":"2026-10-22T17:16:38.540Z","modified_at":"2026-10-22T17:16:38.540Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-54532","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-22T17:16:38.540Z"},{"source":"GitHub Advisory Database","url":"https://github.com/CloudPirates-io/helm-charts/security/advisories/GHSA-gv8x-4mc5-r65r","fetched_at":"2026-10-24T05:41:33.294140Z","source_modified_at":"2026-06-15T19:29:19Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-54532","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","GitHub Advisory Database","EPSS"],"references":[{"source":"CVE List","url":"https://github.com/CloudPirates-io/helm-charts/security/advisories/GHSA-gv8x-4mc5-r65r","tags":["x_refsource_CONFIRM"]},{"source":"CVE List","url":"https://github.com/CloudPirates-io/helm-charts/commit/271d415975a64b7958d2740526dca870b70c8c21","tags":["x_refsource_MISC"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-22T17:16:38.540Z","content_hash":"3abdf30b254e9db5d82d3b3b13366da29a335abb24231dc742bfed8a9306bef2"}}