CVE-2026-11325

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-11325", "assignerOrgId": "a22f1246-ba21-4bb4-a601-ad51614c1513", "state": "PUBLISHED", "assignerShortName": "cloudflare", "dateReserved": "2026-06-04T23:49:45.491Z", "datePublished": "2026-08-12T11:31:15.102Z", "dateUpdated": "2026-08-12T12:06:10.745Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "a22f1246-ba21-4bb4-a601-ad51614c1513", "shortName": "cloudflare", "dateUpdated": "2026-08-12T11:38:41.565Z"}, "title": "cloudflare/pages-action is deprecated \u2014 migration required by September 18th, 2026", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-78", "description": "CWE-78 Improper neutralization of special elements used in an OS command ('OS command injection')", "type": "CWE"}]}, {"descriptions": [{"lang": "en", "cweId": "CWE-1104", "description": "CWE-1104 Use of unmaintained third party components", "type": "CWE"}]}], "affected": [{"vendor": "Cloudflare", "product": "https://github.com/cloudflare/pages-action", "repo": "https://github.com/cloudflare/pages-action", "versions": [{"status": "affected", "version": "0"}], "defaultStatus": "affected"}], "descriptions": [{"lang": "en", "value": "Description\n\n\n\nCloudflare was recently notified by external researchers of vulnerabilities in this archived repository, including a remote code execution issue in `src/index.ts` reachable from certain GitHub Actions workflow configurations. Successful exploitation may expose workflow secrets such as CLOUDFLARE_API_TOKEN and GITHUB_TOKEN to an attacker. Because this repository has been deprecated since 2024, Cloudflare will not be issuing patches. To remediate this issue, we recommend migrating to `cloudflare/wrangler-action` immediately. Consumers who have already migrated are not affected.\n\n\n\n\nSunset Date\n\n\n\nThe cloudflare/pages-action repository will be removed on 2026-09-18. Consumers must complete migration before 18th September to avoid CI disruption.\n\n\n\n\nAffected Versions\n\n\n\nAll published versions of cloudflare/pages-action, including consumers pinned to the v1 moving tag.\n\n\n\n\nPatched Versions\n\n\n\nNone. This repository will not receive further updates, including security patches.\n\n\n\n\nResolution / Migration Path\nMigrate all workflows using cloudflare/pages-action to `cloudflare/wrangler-action` before 2026-09-18. Refer to the wrangler-action README for the equivalent step configuration and migration guidance.\n\n\n\n\nCredit\n\n\n\nThanks to @agentka99 and @beg1nn3r for reporting their findings via Cloudflare's HackerOne program that informe", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>Description</p><p>Cloudflare was recently notified by external researchers of vulnerabilities in this archived repository, including a remote code execution issue in `src/index.ts` reachable from certain GitHub Actions workflow configurations. Successful exploitation may expose workflow secrets such as CLOUDFLARE_API_TOKEN and GITHUB_TOKEN to an attacker. Because this repository has been deprecated since 2024, Cloudflare will not be issuing patches. To remediate this issue, we recommend migrating to `cloudflare/wrangler-action` immediately. Consumers who have already migrated are not affected.</p><br><p>Sunset Date</p><p>The cloudflare/pages-action repository will be removed on 2026-09-18. Consumers must complete migration before 18th September to avoid CI disruption.</p><br><p>Affected Versions</p><p>All published versions of cloudflare/pages-action, including consumers pinned to the v1 moving tag.</p><br><p>Patched Versions</p><p>None. This repository will not receive further updates, including security patches.</p><br><p><b>Resolution / Migration Path</b><br>Migrate all workflows using cloudflare/pages-action to `cloudflare/wrangler-action` before 2026-09-18. Refer to the wrangler-action README for the equivalent step configuration and migration guidance.</p><br><p>Credit</p><p>Thanks to @agentka99 and @beg1nn3r for reporting their findings via Cloudflare's HackerOne program that informe</p><br>"}]}], "references": [{"url": "https://github.com/cloudflare/wrangler-action", "tags": ["vendor-advisory"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseSeverity": "HIGH", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}}], "credits": [{"lang": "en", "value": "@agentka99", "type": "finder"}, {"lang": "en", "value": "@beg1nn3r", "type": "finder"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.4"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-12T12:05:26.217219Z", "id": "CVE-2026-11325", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-12T12:06:10.745Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-11325", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-08-12T12:05:26.217219Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-12T12:05:47.893Z"}}], "cna": {"title": "cloudflare/pages-action is deprecated \u2014 migration required by September 18th, 2026", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "@agentka99"}, {"lang": "en", "type": "finder", "value": "@beg1nn3r"}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"repo": "https://github.com/cloudflare/pages-action", "vendor": "Cloudflare", "product": "https://github.com/cloudflare/pages-action", "versions": [{"status": "affected", "version": "0"}], "defaultStatus": "affected"}], "references": [{"url": "https://github.com/cloudflare/wrangler-action", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "Vulnogram 1.0.4"}, "descriptions": [{"lang": "en", "value": "Description\n\n\n\nCloudflare was recently notified by external researchers of vulnerabilities in this archived repository, including a remote code execution issue in `src/index.ts` reachable from certain GitHub Actions workflow configurations. Successful exploitation may expose workflow secrets such as CLOUDFLARE_API_TOKEN and GITHUB_TOKEN to an attacker. Because this repository has been deprecated since 2024, Cloudflare will not be issuing patches. To remediate this issue, we recommend migrating to `cloudflare/wrangler-action` immediately. Consumers who have already migrated are not affected.\n\n\n\n\nSunset Date\n\n\n\nThe cloudflare/pages-action repository will be removed on 2026-09-18. Consumers must complete migration before 18th September to avoid CI disruption.\n\n\n\n\nAffected Versions\n\n\n\nAll published versions of cloudflare/pages-action, including consumers pinned to the v1 moving tag.\n\n\n\n\nPatched Versions\n\n\n\nNone. This repository will not receive further updates, including security patches.\n\n\n\n\nResolution / Migration Path\nMigrate all workflows using cloudflare/pages-action to `cloudflare/wrangler-action` before 2026-09-18. Refer to the wrangler-action README for the equivalent step configuration and migration guidance.\n\n\n\n\nCredit\n\n\n\nThanks to @agentka99 and @beg1nn3r for reporting their findings via Cloudflare's HackerOne program that informe", "supportingMedia": [{"type": "text/html", "value": "<p>Description</p><p>Cloudflare was recently notified by external researchers of vulnerabilities in this archived repository, including a remote code execution issue in `src/index.ts` reachable from certain GitHub Actions workflow configurations. Successful exploitation may expose workflow secrets such as CLOUDFLARE_API_TOKEN and GITHUB_TOKEN to an attacker. Because this repository has been deprecated since 2024, Cloudflare will not be issuing patches. To remediate this issue, we recommend migrating to `cloudflare/wrangler-action` immediately. Consumers who have already migrated are not affected.</p><br><p>Sunset Date</p><p>The cloudflare/pages-action repository will be removed on 2026-09-18. Consumers must complete migration before 18th September to avoid CI disruption.</p><br><p>Affected Versions</p><p>All published versions of cloudflare/pages-action, including consumers pinned to the v1 moving tag.</p><br><p>Patched Versions</p><p>None. This repository will not receive further updates, including security patches.</p><br><p><b>Resolution / Migration Path</b><br>Migrate all workflows using cloudflare/pages-action to `cloudflare/wrangler-action` before 2026-09-18. Refer to the wrangler-action README for the equivalent step configuration and migration guidance.</p><br><p>Credit</p><p>Thanks to @agentka99 and @beg1nn3r for reporting their findings via Cloudflare's HackerOne program that informe</p><br>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-78", "description": "CWE-78 Improper neutralization of special elements used in an OS command ('OS command injection')"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-1104", "description": "CWE-1104 Use of unmaintained third party components"}]}], "providerMetadata": {"orgId": "a22f1246-ba21-4bb4-a601-ad51614c1513", "shortName": "cloudflare", "dateUpdated": "2026-08-12T11:38:41.565Z"}}}, "cveMetadata": {"cveId": "CVE-2026-11325", "state": "PUBLISHED", "dateUpdated": "2026-08-12T12:06:10.745Z", "dateReserved": "2026-06-04T23:49:45.491Z", "assignerOrgId": "a22f1246-ba21-4bb4-a601-ad51614c1513", "datePublished": "2026-08-12T11:31:15.102Z", "assignerShortName": "cloudflare"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "affected", "product": "https://github.com/cloudflare/pages-action", "repo": "https://github.com/cloudflare/pages-action", "vendor": "Cloudflare", "versions": [{"status": "affected", "version": "0"}]}], "source": "cna@cloudflare.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Description\n\n\n\nCloudflare was recently notified by external researchers of vulnerabilities in this archived repository, including a remote code execution issue in `src/index.ts` reachable from certain GitHub Actions workflow configurations. Successful exploitation may expose workflow secrets such as CLOUDFLARE_API_TOKEN and GITHUB_TOKEN to an attacker. Because this repository has been deprecated since 2024, Cloudflare will not be issuing patches. To remediate this issue, we recommend migrating to `cloudflare/wrangler-action` immediately. Consumers who have already migrated are not affected.\n\n\n\n\nSunset Date\n\n\n\nThe cloudflare/pages-action repository will be removed on 2026-09-18. Consumers must complete migration before 18th September to avoid CI disruption.\n\n\n\n\nAffected Versions\n\n\n\nAll published versions of cloudflare/pages-action, including consumers pinned to the v1 moving tag.\n\n\n\n\nPatched Versions\n\n\n\nNone. This repository will not receive further updates, including security patches.\n\n\n\n\nResolution / Migration Path\nMigrate all workflows using cloudflare/pages-action to `cloudflare/wrangler-action` before 2026-09-18. Refer to the wrangler-action README for the equivalent step configuration and migration guidance.\n\n\n\n\nCredit\n\n\n\nThanks to @agentka99 and @beg1nn3r for reporting their findings via Cloudflare's HackerOne program that informe"}, {"lang": "es", "value": "Descripci\u00f3n\n\nCloudflare fue notificado recientemente por investigadores externos de vulnerabilidades en este repositorio archivado, incluyendo un problema de ejecuci\u00f3n remota de c\u00f3digo en \u201csrc/index.ts\u201d accesible desde ciertas configuraciones de flujo de trabajo de GitHub Actions. La explotaci\u00f3n exitosa puede exponer secretos del flujo de trabajo como CLOUDFLARE_API_TOKEN y GITHUB_TOKEN a un atacante. Dado que este repositorio ha sido desaprobado desde 2024, Cloudflare no emitir\u00e1 parches. Para remediar este problema, recomendamos migrar a \u201ccloudflare/wrangler-action\u201d inmediatamente. Los consumidores que ya han migrado no se ven afectados.\n\nFecha de Retiro\n\nEl repositorio cloudflare/pages-action ser\u00e1 eliminado el 18 de septiembre de 2026. Los consumidores deben completar la migraci\u00f3n antes del 18 de septiembre para evitar interrupciones en la CI.\n\nVersiones Afectadas\n\nTodas las versiones publicadas de cloudflare/pages-action, incluyendo los consumidores anclados a la etiqueta m\u00f3vil v1.\n\nVersiones Parcheadas\n\nNinguna. Este repositorio no recibir\u00e1 m\u00e1s actualizaciones, incluyendo parches de seguridad.\n\nResoluci\u00f3n / Ruta de Migraci\u00f3n\nMigrar todos los flujos de trabajo que utilizan cloudflare/pages-action a \u201ccloudflare/wrangler-action\u201d antes del 18 de septiembre de 2026. Consulte el README de wrangler-action para la configuraci\u00f3n de pasos equivalente y la gu\u00eda de migraci\u00f3n.\n\nCr\u00e9dito\n\nGracias a @agentka99 y @beg1nn3r por informar de sus hallazgos a trav\u00e9s del programa HackerOne de Cloudflare que informaron"}], "id": "CVE-2026-11325", "lastModified": "2026-10-23T20:10:00.160", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "cna@cloudflare.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-11325", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-08-12T12:05:26.217219Z", "version": "2.0.3"}}]}, "published": "2026-08-12T12:17:44.370", "references": [{"source": "cna@cloudflare.com", "url": "https://github.com/cloudflare/wrangler-action"}], "sourceIdentifier": "cna@cloudflare.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-78"}, {"lang": "en", "value": "CWE-1104"}], "source": "cna@cloudflare.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "0"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "https://github.com/cloudflare/pages-action", "source": "cna", "vendor": "Cloudflare"}, "product": "pages-action", "vendor": "cloudflare"}], "created": "2026-08-13T01:30:05.057642+00:00", "updated": "2026-08-13T09:48:45.613460+00:00", "vendors": ["cloudflare", "cloudflare$PRODUCT$pages-action"]}