Full Report
Cloudflare has fixed a vulnerability in Containers and Sandboxes that allowed customers with a Workers Paid account to recover residual data from other customers' containers on the same physical host. [...]
Analysis Summary
# Vulnerability: Cloudflare Containers Cross-Tenant Data Leakage
## CVE Details
- **CVE ID**: Not explicitly assigned in the report (Cloudflare internal tracking)
- **CVSS Score**: Not provided (Estimated High; cross-tenant data exposure)
- **CWE**: CWE-226: Sensitive Information Uncleared Before Reuse
## Affected Systems
- **Products**: Cloudflare Containers (Workers Paid plan)
- **Versions**: All instances active prior to September 19, 2026
- **Configurations**: Shared physical hosts using thin-provisioned storage volumes where block zeroing was disabled for 64 KiB blocks.
## Vulnerability Description
The flaw resided in the configuration of a shared storage pool used by Cloudflare Containers. When a container's root disk was deleted, its physical blocks were returned to a general pool. Due to a configuration that skipped zeroing reused 64 KiB blocks, new containers could be allocated blocks containing residual data from previous tenants.
By writing a smaller data chunk (4 KiB) to a new disk, an attacker could trigger the allocation of a 64 KiB block. Because only 4 KiB was overwritten, the remaining 60 KiB of the block remained intact, allowing the attacker to read residual filesystem metadata, database pages, and application data belonging to former users of that physical block.
## Exploitation
- **Status**: PoC available (demonstrated by researchers); no evidence of exploitation in the wild.
- **Complexity**: Low (requires a Workers Paid account and basic disk write/read scripts).
- **Attack Vector**: Local (requires the ability to run code/containers on the shared infrastructure).
## Impact
- **Confidentiality**: **High** (Exposure of directory listings, SQLite databases, Chromium profiles, .env files, and credentials).
- **Integrity**: **None** (Attackers could not modify active data).
- **Availability**: **None** (Attackers could not disrupt other workloads).
## Remediation
### Patches
- **Vendor Fix**: Cloudflare has applied a global infrastructure fix. They re-enabled mandatory block zeroing, retired all existing container disks, and cleared cached snapshots.
- **User Action**: **No action required** by customers; the fix was applied automatically to the Cloudflare environment.
### Workarounds
- No manual workarounds are necessary as the underlying infrastructure has been updated.
## Detection
- **Indicators of Compromise**: No public IoCs are available. Cloudflare reported that their internal audit of logs and telemetry found no evidence of malicious exploitation.
- **Detection Methods**: Cloudflare monitored for unusual disk read patterns and block allocation anomalies during their investigation.
## References
- **Cloudflare Advisory**: hxxps[://]blog[.]cloudflare[.]com/containers-cross-tenant-vulnerability/
- **Researcher Technical Write-up**: hxxps[://]accomplish[.]ai/blog/escaping-the-cloudflare-sandbox/
- **News Report**: hxxps[://]www[.]bleepingcomputer[.]com/news/security/cloudflare-fixes-containers-cross-tenant-flaw-exposing-customer-data/