Cloudflare Patches Container Flaw That Exposed Other Customers' Leftover Data

Cloudflare has fixed a security flaw in its Containers service that allowed a paying customer to read leftover disk data from other customers' deleted containers. The issue, reported by researcher Oren Yomtov of Accomplish through Cloudflare's bug bounty program, stemmed from how shared storage was managed. Containers use a Linux storage feature that allocates space in small blocks; when a container was deleted, its blocks went back into a shared pool without being properly wiped, meaning fragments of old data could remain and later be read by a different customer's container.

Researchers demonstrated the flaw by writing a small amount of data into reused storage blocks and then reading the full block back at a low level, recovering leftover material including directory listings, database files, browser profile data, configuration files, and credential files from unrelated customers, in a majority of their test attempts across multiple servers and locations. Importantly, an attacker could not target a specific victim, as they had no control over whose leftover data they might encounter, and the exposure was limited to Cloudflare Containers and the related Sandboxes product used to run untrusted code.

Cloudflare says the flaw has been fixed across its infrastructure and that no customer action is required. The researchers reported acting responsibly, stating their testing tools only recorded counts and data types rather than actual file contents, and that no sensitive information was shared beyond what was needed to demonstrate the issue to Cloudflare.