Cloudflare has patched a Cloudflare Workers vulnerability in its Containers and Sandboxes service that could have allowed paid customers to recover residual data from other customers’ containers running on the same physical host. The flaw, reported by security researcher Oren Yomtov at Accomplish through HackerOne on September 4, has been fully mitigated with no evidence of actual customer data exposure.
How the Cloudflare Workers vulnerability worked
The issue stemmed from a shared storage pool configured to skip the zeroing of reused 64 KiB blocks. When a container’s root disk was deleted, its physical blocks returned to a pool serving multiple customer accounts. By writing only 4 KiB to an unused region of a new container’s disk, an attacker could trigger the allocation of a reused 64 KiB physical block. Without the zeroing operation, the remaining 60 KiB would remain readable and potentially contain data from a previous customer.
Testing revealed residual material on 18 of 24 container placements and across 20 of 22 underlying nodes, including directory structures, database pages, and complete SQLite databases. Exploiting the Cloudflare Workers vulnerability would have allowed an attacker to read files such as directory listings, SQLite databases, Chromium profiles, .env files, and credential files—effectively crossing the tenant-isolation boundary that should protect separate customers from one another.
Mitigation and investigation findings
Cloudflare completed all mitigation actions by September 19, 2026. The company removed the setting that caused skipped block zeroing, retired existing container disks, and cleared cached snapshots that may have contained old mappings. The fixes were applied automatically across the infrastructure, requiring no action from customers.
After examining logs, telemetry, and historical data, Cloudflare found no evidence that customer data was exposed via the method described. The researchers who discovered the Cloudflare Workers vulnerability used only scripts that performed checks and returned aggregate counts, not actual disk contents, ensuring no real customer data was compromised during the evaluation. They also did not demonstrate any way to alter another customer’s data or disrupt their workloads on the platform. This follows the pattern seen when Critical Avada WordPress Theme Flaw Allows Zero-Click Remote Code Execution was disclosed, highlighting the importance of rigorous security testing. In a related development, YouTube Shopping adds Amazon to its affiliate program showed how platforms continue expanding their service ecosystems while maintaining security standards.
المصدر: BleepingComputer
