Cloudflare has addressed a cross-tenant data exposure vulnerability in its Containers platform across its global, multi-tenant cloud computing infrastructure This article explores disclosed flaw cloudflare. . This issue could allow one customer's workload to recover residual disk data from another tenant on the same physical host.
The vulnerability also affected Cloudflare Sandboxes, which is built on Containers, but Cloudflare found no evidence of malicious exploitation or customer data compromise in its retained telemetry. Oren Yomtov, a security researcher at Accomplish, responsibly disclosed the flaw through Cloudflare's HackerOne bug bounty program on September 4, 2026. Exploitation required a Workers Paid account, and Cloudflare's automatic workload placement meant an attacker could not choose a victim, host, workload, or specific information.
Underneath, Linux device mapper thin provisioning, or dm-thin, allocates physical storage in 64 KiB blocks only when the virtual disk writes to an unmapped region. Cloudflare's affected shared storage pools enabled the skip_block_zeroing option. Because new allocations weren't cleared, a recycled block could retain bytes belonging to its previous owner until those areas were overwritten.
Following this, Cloudflare developed detection signatures around the attack’s unusual disk I/O pattern: small 4 KiB writes followed by substantial reads from newly allocated 64 KiB blocks. The fleet-wide remediation does not require any customer configuration changes, but organizations should evaluate whether secrets in affected workloads need to be rotated to mitigate potential risks.
