Cloudflare Containers Flaw Could Expose Other Customers’ Data

Cloudflare has fixed a Cloudflare Containers flaw that could let customers recover data left behind by other customers on shared infrastructure. The vulnerability affected Containers and Sandboxes. However, the company says it found no evidence of customer data exposure through this method.

Researcher Reports Shared Storage Vulnerability

Oren Yomtov, a security researcher at Accomplish, reported the vulnerability through HackerOne on September 4.

Cloudflare Containers lets developers run containerized applications alongside Cloudflare Workers. The service requires a Workers Paid account and supports backend services, processing jobs and code execution environments.

The flaw could allow someone with that account type to recover residual files from other customers’ deleted container disks. Potentially accessible material included directory listings, SQLite databases, Chromium profiles, environment files and credential files.

However, an attacker could not choose a specific victim or physical host. The method also did not allow access to disks still actively attached to another customer’s container.

Cloudflare Containers Flaw Left Old Data Readable

The problem involved a shared storage pool that reused physical blocks across customer accounts.

Normally, clearing a reused block prevents a new workload from reading information left by its previous owner. In this case, a storage setting skipped that clearing process.

The pool allocated storage in 64 KiB blocks. However, writing just 4 KiB to an unused disk region could trigger allocation of an entire reused block.

As a result, the remaining 60 KiB could retain readable information from a previous customer’s container.

Researchers detected residual material on 18 of 24 container placements and across 20 of 22 underlying nodes they tested. Their findings included directory structures, database pages and structurally complete SQLite databases.

Cloudflare Finds No Evidence of Customer Data Exposure

According to Cloudflare, the researchers used checking scripts that returned aggregate counts rather than actual disk contents. The company therefore says the evaluation did not expose real customer data.

The researchers also demonstrated no way to modify another customer’s information or disrupt their workloads.

Meanwhile, Cloudflare reviewed logs, telemetry and historical data for signs of exploitation. It found no evidence that anyone had exposed customer data through the reported method.

These findings distinguish the vulnerability’s potential impact from the exposure Cloudflare could confirm.

Infrastructure Fix Requires No Customer Action

Cloudflare removed the setting that allowed its storage pool to skip clearing reused blocks.

In addition, the company retired existing container disks and cleared cached snapshots that might retain old storage mappings. It completed all mitigation work by September 19, 2026.

Cloudflare applied the changes directly to its infrastructure. Consequently, customers do not need to install updates or change their configurations to address this flaw.