CloudPirates Open Source Helm Charts collection contains a vulnerability in GitHub Actions workflow (pull-request.yaml) that executes attacker-controlled code from fork pull requests in privileged context. The vulnerability exposes repository secrets including Docker Hub credentials and tokens without requiring maintainer approval. The issue allows attackers to access sensitive credentials through malicious pull requests. This represents a supply chain security risk affecting CI/CD pipelines. The vulnerability has been patched via commit fcf9302.