VulnSocial

CVE-2026-45131Disclosure

LOWCVSS 10.0 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

CloudPirates Open Source Helm Charts is a collection of Helm charts. Prior to commit fcf9302, a GitHub Actions workflow (pull-request.yaml) executes attacker-controlled code from fork pull requests in a privileged context, exposing repository secrets including Docker Hub credentials and tokens without requiring maintainer approval. This issue has been patched via commit fcf9302.

Back to dashboard
0.5/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-94

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

  • Patch or workaround signal is available
  • 3 mentions across 3 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 3 signals
  • Disclosure: 2 classified signals
  • Peaked 2d ago at 1 mentions (2026-06-01); latest day: 1
  • 3 total mentions across 3 days

Deep dive

Activity timeline3 mentions / 3d
00111Mentions · 2026-06-01: 1Mentions · 2026-06-07: 1Mentions · 2026-06-12: 1Patch / Workaround · 2026-06-07: 1Technical Details · 2026-06-01: 1Technical Details · 2026-06-07: 1Technical Details · 2026-06-12: 106-0106-0706-12
Signal classification2 categories
Disclosure
266.7%
Patch
133.3%
Referenced assets2 URLs
Classification over time
DateTotalLabels
2026-06-011
Disclosure1
2026-06-071
Patch1
2026-06-121
Disclosure1
Full discourse3 posts
  • Kaitan ID Security@KaitanSecurity
    Disclosure

    🧨 CI/CD and Supply Chain: CloudPirates Helm Charts Two related CVSS 10.0 flaws — CVE-2026-45131 and CVE-2026-45132 — affect the CloudPirates Open Source Helm Charts repository. Prior to commit fcf9302, GitHub Actions workflows…

    Post summary

    The post announces two CVSS 10.0 vulnerabilities (CVE-2026-45131/45132) in the CloudPirates Helm Charts, providing the CVE IDs and score but no PoC, exploit code, or patch information.

    1001023
    81 followersView on X
  • Hugo | DevOps | Cybersecurity 🇱🇻@HugoValters
    Patch

    CVE-2026-45131 - Critical supply chain attack in CloudPirates GitHub Actions workflow. CVSS 10. Unauthorized code execution exposes secrets. Patch immediately. #CVE #CloudPirates #infosec #CVEAlert #python #DevOps get FREE Patch NOW! https://www.valtersit.com/cve/CVE-2026-45131

    Post summary

    The post announces a severe supply chain vulnerability (CVE-2026-45131) in a CloudPirates GitHub Actions workflow, stresses immediate patching, and provides a link to the patch. No PoC or exploit code is provided, nor is active exploitation claimed.

    0000050
    919 followersView on X
  • Vulmon Vulnerability Feed@VulmonFeeds
    Disclosure

    CVE-2026-45131 Unauthenticated Code Execution via GitHub Actions in CloudPirates Helm Charts https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-45131

    Post summary

    The text announces CVE-2026-45131, describing unauthenticated code execution possible through GitHub Actions in CloudPirates Helm Charts, without providing a PoC, exploit, or mitigation.

    0000056
    4.0K followersView on X

Explore more

Back to dashboard