What is the CVSS score of EUVD-2026-33666?

EUVD-2026-33666 has a CVSS 3.1 base score of 10.0 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of CloudPirates Helm Charts are affected by EUVD-2026-33666?

CloudPirates Helm Charts contains a critical secret exfiltration vulnerability in GitHub Actions pull-request workflows that allows unauthenticated attackers to steal repository credentials (Docker…

How to fix or mitigate EUVD-2026-33666?

Within 24 hours: (1) identify all uses of CloudPirates Helm Charts across repositories and systems; (2) rotate all Docker Hub credentials, API tokens, and repository secrets that may have been exposed; (3) audit GitHub Actions execution logs for suspicious pull requests and credential access patterns. Within 7 days: (1) implement interim controls (restrict pull_request workflow permissions to read-only, disable secrets access for untrusted fork workflows, enforce manual approval for external pull requests); (2) evaluate replacement Helm chart sources or fork the repository with hardened workflows; (3) conduct forensic review of CI/CD logs for unauthorized credential usage. Within 30 days: (1) establish GitOps controls requiring approval of all GitHub Actions workflows; (2) retire or replace CloudPirates dependency if no security advisory is published; (3) implement secrets scanning and rotation policies across all CI/CD systems.

CloudPirates Helm Charts EUVD-2026-33666

| CVE-2026-45131 CRITICAL

Code Injection (CWE-94)

2026-06-01 GitHub_M

Docker RCE Code Injection

10.0

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

10.0 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Source Code Evidence Fetched

Jun 01, 2026 - 17:15 vuln.today

Analysis Generated

Jun 01, 2026 - 17:15 vuln.today

CVE Published

Jun 01, 2026 - 16:13 nvd

CRITICAL 10.0

DescriptionGitHub Advisory

CloudPirates Open Source Helm Charts is a collection of Helm charts. Prior to commit fcf9302, a GitHub Actions workflow (pull-request.yaml) executes attacker-controlled code from fork pull requests in a privileged context, exposing repository secrets including Docker Hub credentials and tokens without requiring maintainer approval. This issue has been patched via commit fcf9302.

AnalysisAI

Secret exfiltration in CloudPirates Open Source Helm Charts (prior to commit fcf9302) allows unauthenticated attackers to steal repository secrets, including Docker Hub credentials and tokens, by submitting a malicious fork pull request that triggers the pull-request.yaml GitHub Actions workflow in a privileged context. No public exploit is identified at time of analysis, but the attack pattern is a well-known pwn-request misconfiguration that requires no maintainer approval, and the CVSS score of 10.0 (Critical) with scope change reflects compromise of CI/CD secrets that extend beyond the workflow boundary.

Technical ContextAI

The flaw is a classic GitHub Actions 'pwn request' vulnerability rooted in CWE-94 (Improper Control of Generation of Code / Code Injection). The pull-request.yaml workflow ran on events from fork PRs while operating in a privileged context with access to repository secrets (Docker Hub credentials, registry tokens). According to the cpe:2.3:a:cloudpirates-io:helm-charts:* identifier, all versions of the helm-charts repository prior to the fix are affected. The diff shows the workflow previously triggered on 'synchronize' events and lacked an authorization gate, meaning untrusted code from fork branches could execute steps that referenced ${{ secrets.* }} or had access to the GITHUB_TOKEN with write scopes. The fix introduces a separate 'authorize' job pinned to a GitHub 'external' environment for external forks, leveraging environment protection rules to require manual approval before downstream privileged jobs (now gated via 'needs: authorize') will run.

RemediationAI

Upstream fix available at commit fcf930211604652aec15085895b6457bc8b73b54; downstream forks or vendored copies of these workflows should rebase or merge to at or beyond that commit, which introduces an 'authorize' gate job pinned to the 'external' GitHub Environment so that fork-PR runs require manual approval before privileged steps execute. Repository maintainers who ran the vulnerable workflow before patching must assume secret compromise and rotate all repository and organization secrets exposed to that workflow, particularly Docker Hub credentials and any GITHUB_TOKEN-scoped PATs, and review the Docker Hub push history and Helm chart releases for unauthorized images. As compensating controls if the patch cannot be applied immediately, disable the pull-request.yaml workflow for fork events, switch the trigger from 'pull_request_target' to 'pull_request' (which runs without secrets but loses needed privileges), or restrict the workflow to run only on PRs from the same repository - each option trades CI coverage for external contributors against safety. Advisory: https://github.com/CloudPirates-io/helm-charts/security/advisories/GHSA-c47r-c7gw-cvph.