Cloudflare Vulnerabilities and Affected Products
Vulnerabilities associated with https://github.com/cloudflare/pages-action.
Products
Clear product- WARP14 vulnerabilities
- octorpki9 vulnerabilities
- quiche9 vulnerabilities
- WARP Client4 vulnerabilities
- Wrangler4 vulnerabilities
- https://github.com/cloudflare/pingora3 vulnerabilities
- CIRCL2 vulnerabilities
- cloudflared2 vulnerabilities
- cfnts1 vulnerability
- Cloudflare WARP for Windows1 vulnerability
- Cloudflare-WordPress1 vulnerability
- goflow1 vulnerability
- gokey1 vulnerability
- https://github.com/cloudflare/pages-action1 vulnerability
- lol-html1 vulnerability
- lua-resty-json1 vulnerability
- miniflare1 vulnerability
- odoh-rs1 vulnerability
- tokio-boring1 vulnerability
- Universal SSL1 vulnerability
- workerd1 vulnerability
- workers-sdk1 vulnerability
- zlib1 vulnerability
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2026-11325HIGH | cloudflare/pages-action is deprecated — migration required by September 18th, 2026Description Cloudflare was recently notified by external researchers of vulnerabilities in this archived repository, including a remote code execution issue in `src/index.ts` reachable from certain GitHub Actions workflow configurations. Successful exploitation may expose workflow secrets such as CLOUDFLARE_API_TOKEN and GITHUB_TOKEN to an attacker. Because this repository has been deprecated since 2024, Cloudflare will not be issuing patches. To remediate this issue, we recommend migrating t… | CVSS8.8v3.1 | EPSS0.512% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |