CVE-2026-11325

{
  "id": "CVE-2026-11325",
  "sourceIdentifier": "[email protected]",
  "published": "2026-08-12T12:17:44.370",
  "lastModified": "2026-10-23T20:10:00.160",
  "vulnStatus": "Awaiting Analysis",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Description\n\n\n\nCloudflare was recently notified by external researchers of vulnerabilities in this archived repository, including a remote code execution issue in `src/index.ts` reachable from certain GitHub Actions workflow configurations. Successful exploitation may expose workflow secrets such as CLOUDFLARE_API_TOKEN and GITHUB_TOKEN to an attacker. Because this repository has been deprecated since 2024, Cloudflare will not be issuing patches. To remediate this issue, we recommend migrating to `cloudflare/wrangler-action` immediately. Consumers who have already migrated are not affected.\n\n\n\n\nSunset Date\n\n\n\nThe cloudflare/pages-action repository will be removed on 2026-09-18. Consumers must complete migration before 18th September to avoid CI disruption.\n\n\n\n\nAffected Versions\n\n\n\nAll published versions of cloudflare/pages-action, including consumers pinned to the v1 moving tag.\n\n\n\n\nPatched Versions\n\n\n\nNone. This repository will not receive further updates, including security patches.\n\n\n\n\nResolution / Migration Path\nMigrate all workflows using cloudflare/pages-action to `cloudflare/wrangler-action` before 2026-09-18. Refer to the wrangler-action README for the equivalent step configuration and migration guidance.\n\n\n\n\nCredit\n\n\n\nThanks to @agentka99 and @beg1nn3r for reporting their findings via Cloudflare's HackerOne program that informe"
    },
    {
      "lang": "es",
      "value": "Descripción\n\nCloudflare fue notificado recientemente por investigadores externos de vulnerabilidades en este repositorio archivado, incluyendo un problema de ejecución remota de código en “src/index.ts” accesible desde ciertas configuraciones de flujo de trabajo de GitHub Actions. La explotación exitosa puede exponer secretos del flujo de trabajo como CLOUDFLARE_API_TOKEN y GITHUB_TOKEN a un atacante. Dado que este repositorio ha sido desaprobado desde 2024, Cloudflare no emitirá parches. Para remediar este problema, recomendamos migrar a “cloudflare/wrangler-action” inmediatamente. Los consumidores que ya han migrado no se ven afectados.\n\nFecha de Retiro\n\nEl repositorio cloudflare/pages-action será eliminado el 18 de septiembre de 2026. Los consumidores deben completar la migración antes del 18 de septiembre para evitar interrupciones en la CI.\n\nVersiones Afectadas\n\nTodas las versiones publicadas de cloudflare/pages-action, incluyendo los consumidores anclados a la etiqueta móvil v1.\n\nVersiones Parcheadas\n\nNinguna. Este repositorio no recibirá más actualizaciones, incluyendo parches de seguridad.\n\nResolución / Ruta de Migración\nMigrar todos los flujos de trabajo que utilizan cloudflare/pages-action a “cloudflare/wrangler-action” antes del 18 de septiembre de 2026. Consulte el README de wrangler-action para la configuración de pasos equivalente y la guía de migración.\n\nCrédito\n\nGracias a @agentka99 y @beg1nn3r por informar de sus hallazgos a través del programa HackerOne de Cloudflare que informaron"
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Cloudflare",
          "product": "https://github.com/cloudflare/pages-action",
          "defaultStatus": "affected",
          "repo": "https://github.com/cloudflare/pages-action",
          "versions": [
            {
              "version": "0",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "REQUIRED",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.9
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-08-12T12:05:26.217219Z",
          "id": "CVE-2026-11325",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-78"
        },
        {
          "lang": "en",
          "value": "CWE-1104"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/cloudflare/wrangler-action",
      "source": "[email protected]"
    }
  ]
}