CVE-2026-11325: Cloudflare Pages Action RCE Vulnerability

CVE-2026-11325 Overview

CVE-2026-11325 is a remote code execution vulnerability in the deprecated cloudflare/pages-action GitHub Action repository. External researchers reported the flaw to Cloudflare through its HackerOne program. The vulnerable code resides in src/index.ts and is reachable from certain GitHub Actions workflow configurations. Successful exploitation can expose workflow secrets, including CLOUDFLARE_API_TOKEN and GITHUB_TOKEN, to an attacker. Cloudflare deprecated the repository in 2024 and will not issue patches. All published versions of cloudflare/pages-action, including consumers pinned to the v1 moving tag, are affected. The repository will be removed on 2026-09-18.

Critical Impact
Attackers can achieve remote code execution within CI/CD pipelines and exfiltrate sensitive workflow secrets such as CLOUDFLARE_API_TOKEN and GITHUB_TOKEN, enabling supply chain compromise.

Affected Products

cloudflare/pages-action - all published versions
Consumers pinned to the v1 moving tag
GitHub Actions workflows referencing the deprecated repository

Discovery Timeline

2026-08-12 - CVE-2026-11325 published to NVD
2026-08-12 - Last updated in NVD database
2026-09-18 - Scheduled removal of the cloudflare/pages-action repository

Technical Details for CVE-2026-11325

Vulnerability Analysis

The vulnerability is classified under [CWE-78] (Improper Neutralization of Special Elements used in an OS Command, or OS Command Injection). It resides in the src/index.ts file of the cloudflare/pages-action GitHub Action. The action processes inputs supplied through workflow configurations without adequate sanitization. When an attacker controls certain inputs consumed by the action, they can inject arbitrary commands that execute in the context of the GitHub Actions runner.

Because GitHub Actions runners expose environment variables and secrets to executing steps, remote code execution translates directly into secret disclosure. The runner process holds tokens such as CLOUDFLARE_API_TOKEN and the ephemeral GITHUB_TOKEN, both of which grant significant access to Cloudflare Pages projects and the calling GitHub repository.

Root Cause

The root cause is unsafe handling of user-controlled input in src/index.ts that reaches an OS command interpreter. Because the repository is archived and deprecated since 2024, Cloudflare will not publish a patched release. The v1 moving tag continues to serve the vulnerable code to any consuming workflow.

Attack Vector

Exploitation requires an attacker to influence workflow inputs consumed by the action. This can occur through pull request triggers, issue comments, or other event contexts that surface untrusted data to the workflow. Once the malicious input reaches the vulnerable code path in src/index.ts, attacker-supplied commands execute on the runner and secrets are exfiltrated to attacker-controlled infrastructure.

No verified public exploit code is available. The vulnerability mechanism is described in prose only; refer to the Cloudflare wrangler-action repository for the recommended replacement.

Detection Methods for CVE-2026-11325

Indicators of Compromise

Presence of uses: cloudflare/pages-action@v1 or any pinned commit of cloudflare/pages-action in .github/workflows/*.yml files
Unexpected outbound network connections from GitHub Actions runners during Pages deployment steps
Unusual API calls using CLOUDFLARE_API_TOKEN from IP addresses outside GitHub Actions IP ranges
Unexpected use of GITHUB_TOKEN to create branches, tags, or releases outside normal workflow behavior

Detection Strategies

Audit all repositories for workflow files referencing cloudflare/pages-action using code search across GitHub organizations
Review Cloudflare audit logs for API activity attributable to tokens issued to CI/CD pipelines
Inspect GitHub audit logs for anomalous token usage patterns and workflow run failures containing shell errors
Correlate workflow trigger sources (pull requests from forks, issue comments) with subsequent secret-referencing API activity

Monitoring Recommendations

Enable GitHub Actions workflow run logging retention and forward logs to a centralized SIEM
Configure alerts for any workflow that references archived or deprecated third-party actions
Rotate and monitor CLOUDFLARE_API_TOKEN values with narrow scoping, and alert on out-of-band usage
Track GITHUB_TOKEN permission escalations and repository write events tied to Pages deployment workflows

How to Mitigate CVE-2026-11325

Immediate Actions Required

Migrate all workflows from cloudflare/pages-action to cloudflare/wrangler-action before 2026-09-18
Rotate CLOUDFLARE_API_TOKEN credentials used by any workflow that referenced the deprecated action
Regenerate or scope down GITHUB_TOKEN permissions for affected workflows using the permissions: key
Review Cloudflare Pages projects for unauthorized deployments or configuration changes

Patch Information

No patch will be released. Cloudflare has stated that cloudflare/pages-action will receive no further updates, including security patches. The repository is scheduled for removal on 2026-09-18. Consumers who have already migrated to cloudflare/wrangler-action are not affected.

Workarounds

Replace uses: cloudflare/pages-action@v1 with the equivalent cloudflare/wrangler-action step configuration documented in the wrangler-action README
Restrict workflows that consume untrusted input, such as pull_request_target, from accessing repository secrets
Apply least-privilege permissions: blocks to limit GITHUB_TOKEN scope on any workflow still in transition
Pin any replacement action to a full commit SHA rather than a moving tag to prevent supply chain drift

bash

# Configuration example: migrate to cloudflare/wrangler-action
# .github/workflows/deploy.yml
jobs:
  deploy:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      deployments: write
    steps:
      - uses: actions/checkout@v4
      - name: Deploy to Cloudflare Pages
        uses: cloudflare/wrangler-action@v3
        with:
          apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}
          accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
          command: pages deploy ./dist --project-name=my-project