CVE-2026-11325

Description Cloudflare was recently notified by external researchers of vulnerabilities in this archived repository, including a remote code execution issue in `src/index.ts` reachable from certain GitHub Actions workflow configurations. Successful exploitation may expose workflow secrets such as CLOUDFLARE_API_TOKEN and GITHUB_TOKEN to an attacker. Because this repository has been deprecated since 2024, Cloudflare will not be issuing patches. To remediate this issue, we recommend migrating to `cloudflare/wrangler-action` immediately. Consumers who have already migrated are not affected. Sunset Date The cloudflare/pages-action repository will be removed on 2026-09-18. Consumers must complete migration before 18th September to avoid CI disruption. Affected Versions All published versions of cloudflare/pages-action, including consumers pinned to the v1 moving tag. Patched Versions None. This repository will not receive further updates, including security patches. Resolution / Migration Path Migrate all workflows using cloudflare/pages-action to `cloudflare/wrangler-action` before 2026-09-18. Refer to the wrangler-action README for the equivalent step configuration and migration guidance. Credit Thanks to @agentka99 and @beg1nn3r for reporting their findings via Cloudflare's HackerOne program that informe

• CWE-78
• CWE-1104

• https://github.com/cloudflare/wrangler-action

Published

Aug 12, 2026

Last Modified

Aug 28, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-11314Rejected reason: This CVE ID has been rejected or withdrawn …
• CVE-2026-11317A denial of service security issue exists in the affected pr…8.7
• CVE-2026-1132A vulnerability was found in Yonyou KSOA 9.0. The affected e…9.8
• CVE-2026-11321The DataInjection plugin for GLPI 2.15.6 (GLPI 11 builds) co…7.1
• CVE-2026-11322Hermes WebUI prior to v0.51.221 contains a path traversal vu…7.1
• CVE-2026-11324The WooCommerce Placetopay Gateway and PlacetoPay/AvalPay ga…6.1
• CVE-2026-11326OpenAI Atlas before 1.2025.288.15 exposed privileged browser…6
• CVE-2026-11328The Exclusive Addons for Elementor plugin for WordPress is v…6.4
• CVE-2026-11329A vulnerability has been found in onnx onnx-mlir up to 0.5.0…3.6
• CVE-2026-1133A vulnerability was determined in Yonyou KSOA 9.0. The impac…9.8
• CVE-2026-11330A weakness has been identified in thedotmack claude-mem up t…3.6
• CVE-2026-11331An attacker who knows (or guesses) that a resolver uses RPZ …7.5