CVE-2026-11325: Cloudflare pages-action GitHub Actions RCE

Overview

CVE-2026-11325 is a high-severity remote code execution vulnerability in Cloudflare's deprecated cloudflare/pages-action GitHub Actions integration. The flaw exists in src/index.ts and can be exploited through crafted GitHub Actions workflow triggers to execute arbitrary OS commands within the CI runner context — and exfiltrate sensitive secrets such as CLOUDFLARE_API_TOKEN and GITHUB_TOKEN.

Technical Details

The vulnerability is rooted in src/index.ts, the main entrypoint of the cloudflare/pages-action Action. Certain workflow configurations allow an attacker to inject OS-level commands that execute within the GitHub Actions runner. Because the runner environment typically holds privileged secrets, successful exploitation leads to:

• Arbitrary command execution in the CI/CD runner context
• Exfiltration of CLOUDFLARE_API_TOKEN — providing full API access to the linked Cloudflare account
• Exfiltration of GITHUB_TOKEN — allowing repository reads, writes, and further pipeline manipulation

The CVSS vector scores Confidentiality, Integrity, and Availability all as High, with network attack surface, low complexity, and no required privileges — making this straightforward to exploit given a triggerable workflow.

The use of mutable version tags (such as uses: cloudflare/pages-action@v1) is a contributing factor; pinning by commit SHA is a best practice specifically to prevent tag-spoofing and supply-chain attacks, and is especially critical when the upstream repository is no longer actively maintained.

Impact

Any organization using cloudflare/pages-action in GitHub Actions workflows is at risk of:

• Full CI/CD pipeline compromise
• Cloudflare account takeover via API token theft
• Cross-repository spread via stolen GITHUB_TOKEN
• Data exfiltration and lateral movement into cloud infrastructure

Because Cloudflare has deprecated this action and no patch will be released, the risk will remain until workflows are migrated.

Remediation

Immediate action required — migrate before September 18, 2026.

Cloudflare recommends migrating all workflows from cloudflare/pages-action to cloudflare/wrangler-action, which supports Cloudflare Pages deployments and is actively maintained.

Example migration:

# Before (vulnerable — DO NOT USE)
- uses: cloudflare/pages-action@v1
  with:
    apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}
    accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
    projectName: my-project
    directory: dist
 
# After (recommended)
- uses: cloudflare/wrangler-action@v3
  with:
    apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}
    accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
    command: pages deploy dist --project-name=my-project

Additional hardening steps:

1. Audit all workflows now — search for cloudflare/pages-action across your repositories
2. Rotate exposed secrets — if the action has run in any workflow, treat CLOUDFLARE_API_TOKEN and GITHUB_TOKEN as potentially compromised; rotate immediately
3. Pin actions by commit SHA — never use mutable tags (@v1, @main) for third-party actions
4. Apply least-privilege — restrict token scopes to only what each job requires
5. Audit CI logs for unexpected outbound connections or secret usage patterns

References

• NVD — CVE-2026-11325
• cloudflare/wrangler-action (GitHub)
• Cloudflare Pages Deploy Action Migration Guide