Cloudflare Containers Flaw Exposed Cross-Tenant Disk Data

Cloudflare has patched a flaw in its Containers platform that let any customer on a paid Workers plan read leftover data from containers that other customers had previously run on the same server.

The flaw was reported by Accomplish security researcher Oren Yomtov, which also affected Cloudflare Sandboxes.

According to Cloudflare’s disclosure, the company has “no evidence that customer data has been compromised.” Customers don’t need to take any action.

The problem traced back to a single configuration flag. Cloudflare Containers carves each container’s disk out of a shared storage pool using Linux’s dm-thin thin provisioning. Those pools were set to skip_block_zeroing, so storage freed by one customer’s deleted container went to the next customer without being wiped.

Yomtov’s proof of concept wrote tiny 4 KiB chunks into empty regions of a fresh container’s disk. Each write pulled in a recycled 64 KiB block but overwrote only a sliver of it. The other 60 KiB, along with whatever the previous tenant had stored there, stayed readable from the raw disk.

The researchers found residual data on 20 of the 22 servers they landed on, spread across four continents. According to the joint write-up, they recovered directory structures, database pages, and complete SQLite databases.

In its own post, Accomplish goes further, saying the exposed files included Chromium browser profiles, .env files, and credential files. Accomplish also says Cloudflare’s Browser Run service was affected.

An attacker couldn’t pick a victim or read a disk that was still in use, and leftover data wasn’t guaranteed to be there at all. Cloudflare says the researchers’ scripts only counted and format-checked what they found. It adds that the researchers submitted no customer content and have since deleted everything they recovered.

Cloudflare confirmed the issue about three hours after the report and shipped a fix that removed the flag the same evening. Turning the flag off only protected new allocations, though. Old data still sat in running container disks and cached image snapshots, so Cloudflare had to drain hosts, restart every virtual machine, and wipe its image caches. That cleanup didn’t finish until September 19, 15 days after the report was issued.

It built detection signatures from the attack’s telltale pattern of small writes followed by oversized reads and ran them against its retained disk-I/O logs. The only matches came from the researchers and Cloudflare’s own engineers. The company didn’t say how far back those logs go or how long the flag had been enabled in production. Yomtov received a bug bounty, but the amount wasn’t disclosed.

The Cloudflare bug is the sixth sandbox escape Accomplish has published since July. The earlier ones hit Claude Cowork (SharedRoot), Claude Code, Cursor CLI, Docker’s hypervisor, and OpenAI’s Codex sandbox. The firm’s takeaway is that isolation “can fail in many ways.”