What is the CVSS score of EUVD-2026-33665?

EUVD-2026-33665 has a CVSS 3.1 base score of 10.0 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of CloudPirates Helm Charts are affected by EUVD-2026-33665?

CloudPirates Open Source Helm Charts prior to commit fcf9302 contain a critical credential exposure flaw in GitHub Actions workflows that enables attackers to steal Personal Access Tokens and SSH…

How to fix or mitigate EUVD-2026-33665?

Within 24 hours: identify all deployments using CloudPirates Helm Charts versions before commit fcf9302; audit the generate-schema.yaml workflow configuration; immediately rotate all GitHub PAT and SSH signing keys referenced in CI/CD pipelines. Within 7 days: upgrade to commit fcf9302 or later and redeploy; verify workflow configurations no longer use unsafe pull_request_target patterns. Within 30 days: conduct organization-wide GitHub Actions security audit; implement approval gates for all pull_request_target workflows; migrate to OIDC-based authentication where possible.

CloudPirates Helm Charts EUVD-2026-33665

| CVE-2026-45132 CRITICAL

Code Injection (CWE-94)

2026-06-01 GitHub_M

RCE Code Injection Helm Charts

10.0

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

10.0 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Source Code Evidence Fetched

Jun 01, 2026 - 17:15 vuln.today

Analysis Generated

Jun 01, 2026 - 17:15 vuln.today

CVE Published

Jun 01, 2026 - 16:13 nvd

CRITICAL 10.0

DescriptionGitHub Advisory

CloudPirates Open Source Helm Charts is a collection of Helm charts. Prior to commit fcf9302, a GitHub Actions workflow (generate-schema.yaml) exposes sensitive credentials (Personal Access Token and SSH signing key) to fork-controlled code due to unsafe checkout and credential handling practices. This issue has been patched via commit fcf9302.

AnalysisAI

Credential exposure in CloudPirates Open Source Helm Charts (prior to commit fcf9302) allows attackers to steal a Personal Access Token and SSH signing key by submitting a malicious pull request that the vulnerable GitHub Actions workflow checks out and executes with privileged secrets. The repository's generate-schema.yaml workflow used unsafe pull_request_target patterns combined with checkout of fork-controlled code, enabling code injection into a privileged CI context. No public exploit identified at time of analysis, but the attack pattern is well-documented for this class of GitHub Actions misconfiguration.

Technical ContextAI

The vulnerability resides in GitHub Actions workflow files (generate-schema.yaml and pull-request.yaml) within the CloudPirates Helm Charts repository, identified by CPE cpe:2.3:a:cloudpirates-io:helm-charts. The root cause is CWE-94 (Improper Control of Generation of Code / Code Injection) manifesting as a 'pwn request' style flaw: workflows triggered by pull_request_target run with the base repository's secrets and write token, yet the workflow checked out and executed code from the untrusted fork PR head. The patch (commit fcf930211604652aec15085895b6457bc8b73b54) introduces an 'authorize' gate job tied to a protected GitHub environment named 'external' which requires manual approval for forks, and removes the 'synchronize' trigger to prevent automated re-execution on PR updates.

RemediationAI

Upstream fix available via commit fcf930211604652aec15085895b6457bc8b73b54; maintainers and forks of this repository should pull or rebase onto that commit or later, which adds a manual-approval authorize gate via the 'external' GitHub environment and removes the synchronize trigger. Organizations maintaining similar workflows should audit any pull_request_target usage to ensure they never checkout untrusted PR head refs while privileged secrets are accessible, restrict GITHUB_TOKEN permissions to read-only where possible, store sensitive PATs and signing keys in environment-scoped secrets guarded by required reviewers, and consider rotating the previously exposed Personal Access Token and SSH signing key on the assumption they may have been harvested before the patch. Full advisory: https://github.com/CloudPirates-io/helm-charts/security/advisories/GHSA-r874-j8fr-x2pj.