Cloudflare has patched a vulnerability in its Containers product that could have allowed one customer to read leftover fragments of another customer’s data from shared storage, after a security researcher demonstrated the flaw through the company’s bug bounty program on HackerOne.
Cloudflare Containers, available to customers on the Workers Paid plan, lets developers run full containerized applications on Cloudflare’s infrastructure alongside its Workers platform, typically for backend services, batch processing jobs or sandboxed code execution. Behind the scenes, container disks draw their storage from a shared pool of 64 KiB blocks that get assigned and reassigned across different customers’ workloads as containers are created and destroyed.
According to Cloudflare’s own account of the incident, the pool had been configured to skip zeroing, the standard practice of overwriting a storage block with blank data before handing it to a new tenant. That meant that when a container’s root disk was deleted, the physical blocks it had used went back into the shared pool still holding the previous customer’s data. Researcher Oren Yomtov, from the security firm Accomplish, found that writing just 4 KiB of new data was enough to trigger a full 64 KiB block to be reallocated, leaving the remaining 60 KiB of old, unrelated data readable by whoever received that block next.
Yomtov reported the issue through HackerOne on September 4, 2026. In testing across the infrastructure, residual data turned up on 18 of 24 container placements the researcher checked, spread across 20 of 22 different nodes, including leftover directory structures, SQLite database files, Chromium browser profiles, .env configuration files and credentials. Cloudflare said the researcher only ran aggregate counting scripts during testing and did not access or exfiltrate any actual customer data.
Cloudflare removed the setting that allowed blocks to skip zeroing, retired the existing container disks that had been affected, and cleared related cached snapshots, completing the fix by September 19, 2026. The company said that after reviewing its logs and telemetry, it found no evidence that customer data was exposed through this method outside of the researcher’s own controlled tests. No customer action was required, since the fix applied automatically across the platform.
The case is a reminder that multi tenant cloud infrastructure depends heavily on strict isolation between customers at the storage layer, and that a single missed configuration step, like skipping block zeroing, can undermine that isolation even when the rest of a system is well designed.
Source: BleepingComputer
