Cloudflare fixes cross-tenant data flaw in Containers

Cloudflare said it fixed a vulnerability in Containers and Sandboxes that affected customers on the Workers Paid plan. The issue could have let one customer recover leftover data from another customer’s container on the same physical host.

The report reached Cloudflare through HackerOne on 4 September and came from Oren Yomtov, a security researcher at Accomplish. Cloudflare said the fault lay in a shared storage pool that reused 64 KiB blocks without clearing them first.

According to Cloudflare, a write of 4 KiB to unused space in a new container could leave the rest of a reused block readable. The company said this could expose files such as directory listings, SQLite data, Chromium profiles, environment files and credential files.

Cloudflare said its researchers saw residual material on 18 of 24 container placements and on 20 of 22 underlying nodes. It also said the researchers did not obtain real customer data, and did not show that they could alter another customer’s data or disrupt workloads.

Cloudflare said it removed the setting that skipped zeroing, retired container disks and cleared cached snapshots, finishing the work by 19 September 2026. It said it found no evidence that customer data had been exposed through the method described, and that customers did not need to take any action.