Cloudflare has fixed a vulnerability in its Containers and Sandboxes products that could have allowed customers with a Workers Paid account to recover residual data left behind by other customers' containers running on the same physical host. The flaw affected Cloudflare Containers, a Workers Paid service that lets developers run containerized applications on the company's infrastructure alongside Cloudflare Workers. The service is used by developers and companies building applications on Cloudflare, including backend services, processing jobs, and code execution environments. Cloudflare said its mitigation work was complete, and customers do not need to take any action.
The issue was reported through HackerOne on September 4 by Oren Yomtov, a security researcher at the technology company Accomplish. According to Cloudflare's disclosure, the problem lay in a shared storage pool that had been configured to skip zeroing reused 64 KiB blocks. When the thin volume backing a container's root disk was deleted, its physical blocks were returned to a pool that served workloads belonging to multiple customer accounts. Writing only 4 KiB to an unused region of a new container's disk could cause a reused 64 KiB physical block to be allocated, and without the zeroing step only that 4 KiB would overwrite the block, leaving the remaining 60 KiB readable and potentially holding another customer's data.
The researchers found residual material on 18 of 24 container placements and across 20 of 22 underlying nodes tested, including directory structures, database pages, and structurally complete SQLite databases. Exploiting the flaw could have let an attacker read other customers' files, among them directory listings, SQLite databases, Chromium profiles, .env files, and credential files. Cloudflare said a successful exploit would have crossed the tenant-isolation boundary and could have disclosed filesystem metadata, directory structures, database pages, and application data. An attacker would not have had control over the victim or the host and could not have read an actively attached disk.
Cloudflare said the researchers used only scripts that performed checks and returned aggregate counts rather than actual disk contents, so no real customer data was exposed during the evaluation. The researchers also did not demonstrate any way to alter another customer's data or disrupt their workloads on Cloudflare's service. The company removed the setting that caused the skipped block zeroing, retired existing container disks, and cleared cached snapshots that might have contained old mappings, completing all mitigation actions by September 19, 2026.
After reviewing logs, telemetry, and historical data, Cloudflare said it found no evidence that customer data was exposed through the method described by Accomplish. The fixes were applied to its infrastructure automatically. The disclosure follows a familiar pattern for cloud providers, where shared physical hardware and block reuse can create isolation risks if storage is not properly sanitized between tenants. For US businesses running production workloads on Cloudflare's platform, the company's position is that the risk has been closed and no customer-side remediation is required.
More cybersecurity news from TechManNews.
