CVE-2026-11325

HighCVSS 8.8/10Last modified Oct 23, 2026

Description

Description

Cloudflare was recently notified by external researchers of vulnerabilities in this archived repository, including a remote code execution issue in `src/index.ts` reachable from certain GitHub Actions workflow configurations. Successful exploitation may expose workflow secrets such as CLOUDFLARE_API_TOKEN and GITHUB_TOKEN to an attacker. Because this repository has been deprecated since 2024, Cloudflare will not be issuing patches. To remediate this issue, we recommend migrating to `cloudflare/wrangler-action` immediately. Consumers who have already migrated are not affected.

Sunset Date

The cloudflare/pages-action repository will be removed on 2026-09-18. Consumers must complete migration before 18th September to avoid CI disruption.

Affected Versions

All published versions of cloudflare/pages-action, including consumers pinned to the v1 moving tag.

Patched Versions

None. This repository will not receive further updates, including security patches.

Resolution / Migration Path Migrate all workflows using cloudflare/pages-action to `cloudflare/wrangler-action` before 2026-09-18. Refer to the wrangler-action README for the equivalent step configuration and migration guidance.

Credit

Thanks to @agentka99 and @beg1nn3r for reporting their findings via Cloudflare's HackerOne program that informe

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78CWE-1104

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
Cloudflarehttps://github.com/cloudflare/pages-action0

References

Timeline

Published
Aug 12, 2026
Last modified
Oct 23, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-1132508.8Integer overflow in ANGLE in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside thCVE-2026-1132518.8Improper input validation in PDF in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially bypass web origin policy vCVE-2026-1132529.6Uninitialized resource in ANGLE in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker who had compromised the rendCVE-2026-1132538.8Incorrect authorization in Canvas in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to obtain cross-origin data via a crafteCVE-2026-1132548.8Incorrect authorization in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to leak CVE-2026-1132558.8Use after free in CustomTabs in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrarCVE-2026-1132568.8Improper privilege management in Permissions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineeringCVE-2026-1132578.8Use after free in Media in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process and leverCVE-2026-1132588.8Use after free in Chromoting in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to eCVE-2026-1132598.8Missing authorization in Frames in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass system access restrictions into CVE-2026-113266.0OpenAI Atlas before 1.2025.288.15 exposed privileged browser APIs to web content on *.openai.com origins. A cross-site scripting vulnerabiliCVE-2026-1132608.8Improper state validation in Core in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to spoof U
CVE-2026-11325: High severity, CVSS 8.8 | Vulnix