Cloudflare Resolves Cross-Tenant Container Vulnerability Exposing Customer Data

Post Views: 1

Cloudflare resolved a critical vulnerability in its containerized application runtime environment, preventing unauthorized access to residual data from other customers’ workloads.

Overview of the Vulnerability

Cloudflare has resolved a critical vulnerability affecting its containerized application runtime environment, which could have enabled unauthorized access to residual data from other customers’ workloads. The issue was identified in the Containers service, part of the Workers Paid plan, which allows developers to deploy containerized applications on Cloudflare’s infrastructure alongside Workers.

Nature of the Flaw

The vulnerability stemmed from a shared storage configuration that bypassed zeroing of reused 64 KiB storage blocks. When a container’s thin volume was deleted, its physical storage blocks were returned to a pool serving multiple customer accounts. By writing 4 KiB of data to an unused area of a new container’s disk, an attacker could trigger allocation of a 64 KiB block previously used by another customer. The incomplete zeroing process left 60 KiB of unaltered data accessible, potentially exposing files such as directory structures, SQLite databases, Chromium profiles, .env files, and credential stores.

Discovery and Reporting

The flaw was reported on September 4 by Oren Yomtov, a security researcher at Accomplish, through the HackerOne platform. Testing conducted by the researcher revealed residual data in 18 of 24 container placements and 20 of 22 underlying nodes, including complete SQLite databases and filesystem metadata.

Impact and Risk

The vulnerability would have allowed a malicious actor with a Workers Paid account to access data remnants from other customers sharing the same physical host. However, the exploit required no direct interaction with the target system or active disk access. Cloudflare confirmed the researchers performed only passive scans without retrieving actual disk contents, ensuring no customer data was compromised during evaluation.

Mitigation and Resolution

Mitigation measures included disabling the configuration that skipped block zeroing, retiring affected container disks, and purging cached snapshots containing outdated mappings. These actions were completed by September 19, 2026. Post-incident analysis of logs and telemetry found no evidence of data exposure via the described method. The fixes were automatically deployed across Cloudflare’s infrastructure, requiring no customer intervention.

Researcher Findings

Testing conducted by the researcher revealed residual data in 18 of 24 container placements and 20 of 22 underlying nodes, including complete SQLite databases and filesystem metadata.

Conclusion

The vulnerability highlighted risks in shared storage management within multi-tenant environments, emphasizing the importance of proper data sanitization practices. The incident underscores the challenges of maintaining isolation boundaries in cloud infrastructure, particularly when storage optimization techniques intersect with security requirements. Cloudflare’s response demonstrates the effectiveness of coordinated disclosure processes in addressing complex technical risks before they can be exploited at scale.