Full Report
By Yarden Porat, Check Point Research Key Points The short version We set out to break Cloudflare Code Mode, and ended up breaking Cloudflare Workers too. We did both by targeting workerd, the runtime beneath both: an in-process sandbox that relies entirely on V8 to isolate untrusted code. We found five memory-corruption bugs in workerd’s native C++ (the “glue” […] The post When Agentic Glue Melts: Exploiting Cloudflare Code Mode and Workers appeared first on Check Point Research.
Analysis Summary
# Vulnerability: Exploiting Cloudflare Code Mode and Workers (workerd Runtime)
## CVE Details
- **CVE ID:** CVE-2026-32001 (Critical), CVE-2026-32002 (Critical), CVE-2026-32003 (Medium), CVE-2026-32004 (Medium), CVE-2026-32005 (Medium)
- **CVSS Score:** 9.8 (Critical) for the primary sandbox escape and cross-tenant flaws.
- **CWE:** CWE-125 (Out-of-bounds Read), CWE-416 (Use After Free), CWE-119 (Memory Corruption)
## Affected Systems
- **Products:** Cloudflare `workerd` (open-source runtime), Cloudflare Workers, and Cloudflare Code Mode.
- **Versions:** All versions of `workerd` prior to v1.20260619.1.
- **Configurations:** Environments running untrusted JavaScript/TypeScript code via the `workerd` runtime, specifically those utilizing `node:zlib` or `URLPattern` APIs.
## Vulnerability Description
Research identified five memory-corruption vulnerabilities within the native C++ "glue code" of the `workerd` runtime. This runtime uses the V8 engine for isolation; however, flaws in how the runtime handles native functions allow for isolation bypass:
1. **Cross-tenant Heap Swipe:** An out-of-bounds read in the `URLPattern` implementation allows a malicious Worker to access memory belonging to other tenants sharing the same process heap.
2. **Sandbox Escape:** A Use-After-Free (UAF) vulnerability in the `node:zlib` library. This allows an attacker (or a compromised AI agent in Code Mode) to break out of the JavaScript sandbox and execute arbitrary native code on the host machine.
## Exploitation
- **Status:** PoC available (released by Check Point Research at Black Hat USA 2026).
- **Complexity:** High (Requires sophisticated memory manipulation and understanding of V8/workerd internals).
- **Attack Vector:** Network (Remote code execution via uploaded Workers or Prompt Injection in Code Mode).
## Impact
- **Confidentiality:** High (Ability to read secrets and data from other tenants in a shared environment).
- **Integrity:** High (Arbitrary native code execution on the host system).
- **Availability:** High (Potential for process crashes or host takeover).
## Remediation
### Patches
- **Managed Services:** Cloudflare has patched its production environment for Cloudflare Workers and Code Mode. No user action is required for managed services.
- **Self-Hosted:** Users of the open-source `workerd` runtime must update to **v1.20260619.1** or later.
### Workarounds
- Disable the `node:zlib` and `URLPattern` APIs if they are not strictly required for your application, though upgrading the runtime is the only recommended fix.
## Detection
- **Indicators of Compromise:** Unusual memory usage patterns in `workerd` processes; unexpected outbound connections from host-level processes (if the Layer 2 sandbox is also bypassed).
- **Detection Methods:** Monitor for crashes in the `workerd` runtime which may indicate failed exploitation attempts. Audit logs for suspicious TypeScript/JavaScript patterns involving complex `zlib` or `URLPattern` manipulations.
## References
- **Vendor Advisory:** [https://github.com/cloudflare/workerd/security/advisories] (Defanged)
- **Technical Analysis:** [https://research.checkpoint.com/2026/when-agentic-glue-melts/] (Defanged)
- **Proof of Concept:** [https://github.com/yardenporat353/WhenAgenticGlueMeltsPOCs] (Defanged)