Back to Feed
VulnerabilitiesSep 27, 2026

Cloudflare fixes Containers cross-tenant flaw exposing customer data

Cloudflare fixes Containers cross-tenant flaw exposing customer data

Cloudflare has patched a vulnerability in its Containers and Sandboxes service that could have allowed Workers Paid account holders to access residual data from other customers' containers on the same physical host. The flaw involved a shared storage pool that reused data blocks without proper zeroing, potentially exposing directory listings, databases, and credentials. Cloudflare stated that no customer data was actually exposed and has since removed the problematic setting and cleared affected storage.

AI summary of the linked source. Not reviewed by an editor. How this works

Vendor Watch

Run Cloudflare?

Get an email when a new story names Cloudflare, usually within the hour.

Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy

The lesson from this incident

Full lesson

The root cause of this vulnerability was a misconfigured shared storage pool that reused data blocks without clearing (zeroing) them between tenant allocations — a classic configuration management failure in multi-tenant environments. This meant one customer's container could read residual data left behind by another customer, including sensitive artifacts like directory listings, databases, and credentials. In cloud and shared infrastructure environments, proper memory and storage sanitization between tenant workloads is a fundamental security requirement, not an optional hardening step. While Cloudflare confirmed no actual data exposure occurred, the potential blast radius — credential theft, lateral movement, and data breaches across customer boundaries — underscores how infrastructure-level misconfigurations can completely undermine tenant isolation guarantees. This incident is a reminder that multi-tenant security is only as strong as the least-sanitized shared resource.

What helps against this

How we list vendors

Entities

Cloudflare (vendor)Containers (product)Sandboxes (product)Workers Paid (product)SQLite (technology)Chromium (technology)