CVE-2026-11325
cloudflare/pages-action is deprecated — migration required by September 18th, 2026
Description
Description Cloudflare was recently notified by external researchers of vulnerabilities in this archived repository, including a remote code execution issue in `src/index.ts` reachable from certain GitHub Actions workflow configurations. Successful exploitation may expose workflow secrets such as CLOUDFLARE_API_TOKEN and GITHUB_TOKEN to an attacker. Because this repository has been deprecated since 2024, Cloudflare will not be issuing patches. To remediate this issue, we recommend migrating to `cloudflare/wrangler-action` immediately. Consumers who have already migrated are not affected. Sunset Date The cloudflare/pages-action repository will be removed on 2026-09-18. Consumers must complete migration before 18th September to avoid CI disruption. Affected Versions All published versions of cloudflare/pages-action, including consumers pinned to the v1 moving tag. Patched Versions None. This repository will not receive further updates, including security patches. Resolution / Migration Path Migrate all workflows using cloudflare/pages-action to `cloudflare/wrangler-action` before 2026-09-18. Refer to the wrangler-action README for the equivalent step configuration and migration guidance. Credit Thanks to @agentka99 and @beg1nn3r for reporting their findings via Cloudflare's HackerOne program that informe
INFO
Published Date :
Aug. 12, 2026, 12:17 p.m.
Last Modified :
Oct. 23, 2026, 8:10 p.m.
Remotely Exploit :
Yes !
Source :
[email protected]
Affected Products
The following products are affected by CVE-2026-11325
vulnerability.
Even if cvefeed.io is aware of the exact versions of the
products
that
are
affected, the information is not represented in the table below.
No affected product recoded yet
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | |||||
| CVSS 3.1 | HIGH | a22f1246-ba21-4bb4-a601-ad51614c1513 | ||||
| CVSS 3.1 | HIGH | [email protected] | ||||
| CVSS 3.1 | HIGH | MITRE-CVE |
Solution
- Migrate all workflows to cloudflare/wrangler-action.
- Refer to wrangler-action README for guidance.
- Remove all usages of cloudflare/pages-action.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-11325.
| URL | Resource |
|---|---|
| https://github.com/cloudflare/wrangler-action |
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-11325 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-11325
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-11325 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-11325 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Translated by [email protected]
Oct. 23, 2026
Action Type Old Value New Value Added Translation Title: https://github.com/cloudflare/pages-action de Cloudflare, Description: Descripción Cloudflare fue notificado recientemente por investigadores externos de vulnerabilidades en este repositorio archivado, incluyendo un problema de ejecución remota de código en “src/index.ts” accesible desde ciertas configuraciones de flujo de trabajo de GitHub Actions. La explotación exitosa puede exponer secretos del flujo de trabajo como CLOUDFLARE_API_TOKEN y GITHUB_TOKEN a un atacante. Dado que este repositorio ha sido desaprobado desde 2024, Cloudflare no emitirá parches. Para remediar este problema, recomendamos migrar a “cloudflare/wrangler-action” inmediatamente. Los consumidores que ya han migrado no se ven afectados. Fecha de Retiro El repositorio cloudflare/pages-action será eliminado el 18 de septiembre de 2026. Los consumidores deben completar la migración antes del 18 de septiembre para evitar interrupciones en la CI. Versiones Afectadas Todas las versiones publicadas de cloudflare/pages-action, incluyendo los consumidores anclados a la etiqueta móvil v1. Versiones Parcheadas Ninguna. Este repositorio no recibirá más actualizaciones, incluyendo parches de seguridad. Resolución / Ruta de Migración Migrar todos los flujos de trabajo que utilizan cloudflare/pages-action a “cloudflare/wrangler-action” antes del 18 de septiembre de 2026. Consulte el README de wrangler-action para la configuración de pasos equivalente y la guía de migración. Crédito Gracias a @agentka99 y @beg1nn3r por informar de sus hallazgos a través del programa HackerOne de Cloudflare que informaron -
New CVE Received by [email protected]
Aug. 12, 2026
Action Type Old Value New Value Added Affected [{'repo': 'https://github.com/cloudflare/pages-action', 'vendor': 'Cloudflare', 'product': 'https://github.com/cloudflare/pages-action', 'versions': [{'status': 'affected', 'version': '0'}], 'defaultStatus': 'affected'}] Added Description Description Cloudflare was recently notified by external researchers of vulnerabilities in this archived repository, including a remote code execution issue in `src/index.ts` reachable from certain GitHub Actions workflow configurations. Successful exploitation may expose workflow secrets such as CLOUDFLARE_API_TOKEN and GITHUB_TOKEN to an attacker. Because this repository has been deprecated since 2024, Cloudflare will not be issuing patches. To remediate this issue, we recommend migrating to `cloudflare/wrangler-action` immediately. Consumers who have already migrated are not affected. Sunset Date The cloudflare/pages-action repository will be removed on 2026-09-18. Consumers must complete migration before 18th September to avoid CI disruption. Affected Versions All published versions of cloudflare/pages-action, including consumers pinned to the v1 moving tag. Patched Versions None. This repository will not receive further updates, including security patches. Resolution / Migration Path Migrate all workflows using cloudflare/pages-action to `cloudflare/wrangler-action` before 2026-09-18. Refer to the wrangler-action README for the equivalent step configuration and migration guidance. Credit Thanks to @agentka99 and @beg1nn3r for reporting their findings via Cloudflare's HackerOne program that informe Added CVSS V3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Added CWE CWE-78 Added CWE CWE-1104 Added Reference https://github.com/cloudflare/wrangler-action -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Aug. 12, 2026
Action Type Old Value New Value Added SSVC {'id': 'CVE-2026-11325', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'none'}, {'automatable': 'no'}, {'technicalImpact': 'total'}], 'version': '2.0.3', 'timestamp': '2026-08-12T12:05:26.217219Z'}