How Cloudflare addressed a cross-tenant data exposure vulnerability in Containers

Cloudflare disclosed and remediated a vulnerability in its multi-tenant Containers and Sandboxes services after researcher Oren Yomtov of Accomplish reported it through HackerOne on September 4, 2026. The issue arose because Linux dm-thin storage pools had block zeroing disabled, allowing a newly allocated 64 KiB disk block to retain up to 60 KiB of data from a previously deleted container when only part of the block was overwritten. Researchers demonstrated that a Workers Paid customer could potentially recover residual filesystem metadata, database pages, directory structures, and application data from other customers placed on the same host, though they could not choose a target, host, workload, or specific data and could not access active disks or alter other customers’ data. Cloudflare removed the setting that bypassed block clearing, retired existing container disks, cleared cached image snapshots, and completed fleet-wide cleanup by September 19. Its review of historical disk-I/O telemetry found activity matching the technique only from the researchers and authorized Cloudflare validation, with no evidence of malicious exploitation or customer data compromise.

No tracked trend matches for this post yet.

Use this post, company, and trend context to find content marketing opportunities, perform competitive analysis, or address product feature gaps via the Plushcap MCP server or the Plushcap API.