Ethical Hacking News
Cloudflare has fixed a critical vulnerability in its Container storage solution, which allowed one container to read data from another customer's leftover disk space. The vulnerability was caused by a flaw in the thin provisioning feature used by Cloudflare Containers and was reported by researchers at Accomplish through Cloudflare's bug bounty program. While customers do not need to take any action to be protected, the incident highlights the importance of regular security audits and testing to identify potential vulnerabilities in container storage solutions.
Cloudflare recently fixed a critical vulnerability in its Container storage solution. A flaw in thin provisioning caused the issue, allowing containers to read sensitive data from previous containers. Researchers found leftover data on 18 of 24 servers and 20 of 22 underlying machines across four continents. Cloudflare fixed the vulnerability in two steps, including turning wiping on for newly handed-out blocks and clearing caches. Customers need not take action to be protected, as the vulnerability has been fixed across Cloudflare's service.
Cloudflare, a leading cybersecurity firm, has recently fixed a critical vulnerability in its Container storage solution, which allowed one container to read data from another customer's leftover disk space. This discovery was made by researchers at the security firm Accomplish, who reported the issue through Cloudflare's bug bounty program on September 4, 2026.
According to the researchers, the vulnerability was caused by a flaw in the thin provisioning feature used by Cloudflare Containers, which allows multiple containers to share the same disk space. The issue arose when a container was deleted, and its blocks were returned to a shared pool, where they could be reused by other containers. However, the researchers discovered that the pool was set to skip wiping a block before handing it to the next container, which allowed the reuse of blocks containing sensitive data from previous containers.
The researchers wrote a small four-kilobyte block into unused space and then read the whole block back at the raw disk level. This revealed that the 60 kilobytes they had not written still held bytes from a previous container, including directory structures, database pages, and structurally complete SQLite databases. The researchers also confirmed that the recovered data was kept private and securely deleted after they submitted it to Cloudflare.
Cloudflare fixed the vulnerability in two steps. First, it turned wiping back on for newly handed-out blocks, which stopped the reported method from working. However, this change did not clean blocks already mapped into running container disks or into each server's cache of prepared image layers, which a new container could inherit and read. Therefore, Cloudflare also retired every running container disk and cleared those caches, draining and restarting servers during quiet hours.
The researchers reported finding leftover material on 18 of 24 tries, each on a server Cloudflare chose, and on 20 of 22 underlying machines across four continents. They also confirmed that the researchers did not show that the flaw could change another customer's live data or take a workload offline.
Cloudflare has stated that customers need to do nothing to be protected, as the company has fixed the vulnerability across its service. However, the incident highlights the importance of regular security audits and testing to identify potential vulnerabilities in container storage solutions.
In this article, we will delve deeper into the details of the vulnerability, its impact, and the steps Cloudflare has taken to fix it. We will also explore the implications of this incident for customers who rely on Cloudflare's Container storage solution.
Related Information:
https://www.ethicalhackingnews.com/articles/Cloudflare-Fixes-Critical-Vulnerability-in-Container-Storage-Allowing-Unintended-Access-to-Customer-Data-ehn.shtml
https://thehackernews.com/2026/09/cloudflare-fixes-flaw-that-let-one.html
https://blog.cloudflare.com/containers-cross-tenant-vulnerability/
Published: Fri Sep 25 01:43:07 2026 by llama3.2 3B Q4_K_M
