Client Executive - SLED

Cloudflare patches container flaw that leaked other customers' deleted data. "A misconfigured thin-provisioning pool let any paying Cloudflare Containers customer read up to 60 KB of leftover disk data from previous tenants, including SQLite databases,.env files, and browser profiles. Cloudflare says no one else exploited it, but won't say how long the setting was broken." Devon Vance Key Takeaways * - A disabled block-wipe setting in Cloudflare's thin-provisioned storage pool let new containers read up to 60 KB of previous tenants' deleted data. * - Researchers recovered SQLite databases,.env files, Chromium profiles, and credential files across 20 of 22 physical servers on four continents. * - Cloudflare fixed the issue in two phases: re-enabling wiping (Sept 14) then retiring all running container disks and clearing image caches (completed Sept 19). * - Log analysis found no evidence of third-party exploitation, but Cloudflare did not disclose the log retention window or when the misconfiguration began. * - The same researchers have now disclosed six sandbox escapes since July across Anthropic, Cursor, Docker, OpenAI, and Cloudflare, signaling a systemic isolation problem in AI-era compute platforms. Cloudflare just disclosed a cross-tenant data leak in its Containers platform that sounds like a textbook multi-tenancy nightmare, except the company says nobody but the researchers who found it actually exploited the thing. Here's what happened. Cloudflare Containers runs customer workloads on shared servers using Linux thin provisioning. Each container gets a virtual disk carved into 64-kilobyte blocks. When a container dies, its blocks go back into a global pool. That pool was supposed to wipe blocks before handing them out again. It didn't. Wiping was turned off. So when a new container wrote a tiny 4 KB file into a recycled block, the remaining 60 KB still held whatever the last tenant left behind. The researchers, Oren Yomtov at Accomplish, just read the raw block back. They found directory listings, intact SQLite databases, Chromium browser profiles,.env files, credential files. Real customer data. Not metadata. Actual files. They tested this 24 times across servers Cloudflare picked. Eighteen tries yielded leftovers. Across 22 physical machines on four continents, 20 leaked data. That's not a fluke. That's a systemic configuration error. The fix took two passes. Cloudflare's first move, re-enabling block wiping for newly allocated blocks, stopped the researchers' proof-of-concept cold. They confirmed it on September 14. But that only protected new allocations. Every container already running still had mapped blocks that could leak. Every cached image layer on every server still held the dirty blocks. So Cloudflare did the nuclear option: retired every running container disk, flushed every image-layer cache, drained and restarted servers during quiet hours. Finished September 19. Disclosed five days later. Customers need to do nothing. That's the official line. And technically true, the infrastructure is clean now. But if you ran secrets in a container that got deleted before September 19, those secrets were readable by anyone who spun up a container on the same server afterward. You can't rotate what you don't know leaked. What Cloudflare isn't saying. The post mentions detection signatures built from the researchers' exploit and Cloudflare's own copy. They scanned retained disk-activity logs. Found only the researchers and their own engineers. Good. But they didn't say how far back those logs go. They didn't say when the unsafe setting was first applied. So the exposure window is a black box. Could be weeks. Could be months. Also notable: the researchers say the same disk setup hit Cloudflare's Browser Run product. Cloudflare's disclosure names Containers and Sandboxes, which runs on Containers and markets itself as a safe sandbox for untrusted code, including AI-agent code, but stays silent on Browser Run. That omission is either an oversight or a deliberate scope limit. Either way, it's the kind of detail that makes security teams nervous. The bigger pattern. Yomtov and Accomplish have now published six sandbox escapes since July. Anthropic's Claude Cowork and Claude Code. Cursor's CLI. Docker. OpenAI's Codex. Now Cloudflare. That's not a coincidence. It's a pattern. The industry is rushing to run untrusted code, AI agents, user-submitted scripts, browser automation, on shared infrastructure. The isolation boundaries are getting tested hard. And they're cracking. Thin provisioning isn't new. The wipe-on-reuse default isn't new. Someone flipped a setting, or never set it, and nobody caught it until a bug bounty hunter did. That's the real story. Not the exploit. that a basic storage hygiene control got disabled in a production multi-tenant platform and stayed that way long enough to hit 20 of 22 machines globally. Cloudflare moved fast once they knew. Two-phase fix in two weeks. Full fleet rotation. Public disclosure. That's competent incident response. But competent response doesn't erase that the guardrail was missing in the first place. If you're building on Cloudflare Containers or Sandboxes today, the platform is clean. But you're also trusting that the next config drift gets caught before a researcher has to find it. That trust just took a hit. Frequently asked questions. Do Cloudflare Containers customers need to take any action after this fix? Cloudflare says no customer action is required, the infrastructure has been fully remediated. However, any secrets that existed in containers deleted before September 19 may have been readable by other tenants during the exposure window. What types of data were actually recovered in the researchers' tests? Directory structures, structurally complete SQLite databases, Chromium browser profiles,.env files, and credential files, all described as other customers' actual files, not metadata. Was Cloudflare's Browser Run product affected? The researchers state the same disk setup affected Browser Run, but Cloudflare's official disclosure only names Containers and Sandboxes as impacted. Cloudflare has not publicly confirmed or denied Browser Run exposure. Discussion (0). You must be signed in to post a comment. No comments yet. Start the conversation!

Cloudflare fixes flaw that let one container read another customer's leftover disk data. 2026-09-25 08:09 A flaw in Cloudflare Containers let a paying customer read data that other customers' containers had left behind on the same server, Cloudflare and the researchers who found it said on Thursday. The data came from disk space that earlier containers had used and given up, not from any live workload, and an attacker could not choose whose data they got, according to Cloudflare. The company Read the original article: Cloudflare has addressed a cross-tenant data exposure vulnerability in its Containers platform that could have allowed one customer's workload to recover... Hacking & Cracking September 25, 2026 Cloudflare has patched a cross-tenant data exposure vulnerability in its Containers platform across its global, multi-tenant cloud computing... September 25, 2026 In "Cyber Security News" N-able says attackers bypassed N-central authentication, reached managed client devices and installed Cloudflare tunnels that survived server access... August 3, 2026

MKR v Cloudflare: High Court orders domain providers to disclose details of anonymous harasser. High Court orders domain providers to disclose details identifying the person behind targeted harassment. The High Court has ordered three internet infrastructure companies to disclose information identifying whoever is behind a long-running campaign that has associated the claimant's name with thousands of domains redirecting to adult content. In MKR v Cloudflare Limited & Ors [2026] EWHC 2452 (KB), Mrs Justice Hill made Norwich Pharmacal orders against the second to fourth defendants, Best value * | Unlimited access to 20,000+ articles * | Monthly print & digital editions * | Full access to its archive * | Available for individuals & organisations One-time purchase Buy this article. Download a PDF copy of this article for permanent access, no subscription needed.