How Cloudflare addressed a cross-tenant data exposure vulnerability in Containers
Cloudflare fixed a Containers flaw that could expose residual cross-tenant disk data; no malicious exploitation was found.
On September 4, 2026, Accomplish researcher Oren Yomtov responsibly reported a cross-tenant data exposure in Cloudflare Containers and Sandboxes. Containers run in Firecracker VMs with Linux dm-thin provisioning and skip_block_zeroing, so a 4 KiB write into a reallocated 64 KiB block could leave up to 60 KiB of a previous customer's data readable. A Workers Paid customer could not choose the host or target a specific tenant, but researchers found residual directory, database, and SQLite data on 18 of 24 placements. Cloudflare says the fleet is fixed, no customer changes are required, and telemetry showed no malicious exploitation.
- dm-thin skip_block_zeroing left residual data in reused blocks.
- A 4 KiB write could leave 60 KiB from a prior tenant.
- Residual data was observed on 18 of 24 placements.
- A Workers Paid account could not target a specific customer.
- Cloudflare patched the fleet and found no malicious exploitation.
- Vendors
- Cloudflare
- Organizations
- CloudflareAccomplish
From the original article
7 min read at blog.cloudflare.com
External security researchers at Accomplish identified a vulnerability in Cloudflare Containers that could expose residual disk data from previous workloads. We explain how the issue worked, how we investigated it, and the steps we took to remediate it.
By Rushil Mehra · blog.cloudflare.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.