Executive brief
A security flaw in the automated testing system for CloudPirates Helm charts allowed unauthorized individuals to run malicious code. By submitting a fake update to the project, an attacker could automatically trigger a process that steals sensitive credentials, such as Docker Hub login details. This could allow an attacker to tamper with software images or gain unauthorized access to the project's infrastructure.
Technical details
The vulnerability exists in the 'pull-request.yaml' GitHub Actions workflow, specifically within the 'integration-test' job. The workflow uses the 'pull_request_target' trigger, which grants the workflow access to repository secrets and a privileged GITHUB_TOKEN. The workflow incorrectly checks out code from a contributor's fork and then executes a script ('test-charts.sh') from that untrusted workspace while authenticated to Docker Hub. An attacker can modify this script in a fork and open a pull request to automatically exfiltrate 'REGISTRY_USER' and 'REGISTRY_PASSWORD' secrets or perform unauthorized repository modifications. The issue was addressed in commit fcf9302 by implementing environment protection gates and requiring explicit approval for workflow execution.
Affected products
- CloudPirates-io Open Source Helm Charts Prior to commit fcf9302
Timeline
- 2026-05-12: advisory: GitHub Security Advisory published by maintainers
- 2026-06-01: disclosed: CVE published to NVD
- 2026-06-01: patched: Fix committed to repository