Cloudflare Patches Cross-Tenant Data Exposure Flaw in Containers
Cloudflare has remediated a cross-tenant data exposure vulnerability in its Containers and Sandboxes infrastructure, which could have allowed certain users to recover residual disk blocks from shared hosts.
Before you start: versions, package names and storage identifiers change over time. Check the commands against the official documentation for your setup before running them, especially anything that creates, deletes or overwrites data.
Incident Overview and Discovery
Cloudflare has successfully remediated a cross-tenant data exposure vulnerability affecting its Containers and Sandboxes products. The issue was responsibly disclosed on September 4, 2026, by security researcher Oren Yomtov from Accomplish via the company’s bug bounty program.
According to the technical analysis, the vulnerability allowed a customer utilizing a Workers Paid account to recover residual disk blocks previously used by other containers hosted on the same multi-tenant physical hardware. Cloudflare confirmed that the attack vector could not target specific customers or active disks, and historical telemetry showed no evidence of malicious exploitation outside of authorized validation by the researchers and engineering teams.
Underlying Storage Mechanics
The security flaw stemmed from how Linux device mapper thin provisioning (dm-thin) managed writable root disks within Firecracker virtual machines. The affected storage pools utilized a 64 KiB thin-block size alongside a specific configuration option known as skip_block_zeroing.
With this configuration enabled, the storage driver bypassed zeroing out newly allocated blocks before exposing them to workloads. When a previously used block was reassigned to a new thin volume, a partial write would overwrite only a fraction of the 64 KiB block, leaving the remainder containing residual data from the previous owner. The proof of concept demonstrated that targeted partial writes could trigger physical block allocation and allow raw reads of unwritten regions.
Remediation and Fleet-Wide Cleanup
Cloudflare deployed a two-phase mitigation strategy to secure the infrastructure. First, the configuration flag skip_block_zeroing was removed across the entire container fleet, restoring the default behavior of clearing newly allocated blocks.
Because zeroing new allocations did not sanitize existing mappings already cached in running container disks or OCI image layers, Cloudflare also drained hosts, restarted virtual machines during off-peak windows, and cleared image caches to ensure all disks and layers were recreated using zeroed storage allocations. The company confirmed that no configuration changes were required for end users.
Source
Official announcement or documentation
Some links on this page may be affiliate links. If you buy through them we may earn a commission at no extra cost to you. See our affiliate disclosure.
