Cloudflare has remediated a vulnerability in Containers and Sandboxes that could expose residual data from one customer's workload to another customer sharing the same physical host. The company says it found no evidence that the technique was used maliciously or that customer data was compromised.
Security researcher Oren Yomtov of Accomplish reported the issue through Cloudflare's bug bounty program on September 4. Cloudflare's disclosure says the affected services run customer workloads on multi-tenant infrastructure, with placement handled automatically rather than chosen by customers.
Reused blocks were not fully cleared
The flaw was in a shared storage pool configured to skip zeroing reused 64 KiB blocks. A researcher could write 4 KiB into an unused region of a new container's disk and cause the system to allocate a block that had previously belonged to another container. The new write replaced only 4 KiB, potentially leaving the remaining 60 KiB readable.
BleepingComputer reports that controlled tests recovered directory listings, SQLite database pages, Chromium profiles, environment files and credential files. The technique could not select a particular victim or host, read an actively attached disk, modify another customer's data or disrupt another workload.
Cloudflare says the researchers used scripts that returned aggregate counts rather than collecting actual disk contents. Its review of retained telemetry found activity from the researchers and Cloudflare engineers validating the issue, but no additional activity consistent with exploitation.
Fleet-wide cleanup is complete
Cloudflare removed the setting that skipped block zeroing, retired running container disks and cleared cached image snapshots that might contain old mappings. The company says all mitigation work was complete by September 19.
The fix was applied by Cloudflare across its infrastructure, so customers do not need to update software or change their configuration. The incident nevertheless shows why storage cleanup is part of tenant isolation: containers can be separated at runtime while reused disk blocks still carry data across that boundary if they are not cleared before reassignment.
