CVE-2026-45131 affects CloudPirates Open Source Helm Charts collection. A vulnerability in the GitHub Actions workflow (pull-request.yaml) allows execution of attacker-controlled code from fork pull requests in a privileged context. This exposes repository secrets including Docker Hub credentials and tokens without requiring maintainer approval. The issue occurs prior to commit fcf9302 and has been patched via the same commit. The vulnerability represents a supply chain security risk through compromised CI/CD workflows.