Cloudflare fixes Containers cross-tenant flaw exposing customer data
Cloudflare fixes Containers cross-tenant flaw exposing customer data
Cloudflare has patched a vulnerability in its Containers and Sandboxes service that could have allowed Workers Paid account holders to access residual data from other customers' containers on the same physical host. The flaw involved a shared storage pool that reused data blocks without proper zeroing, potentially exposing directory listings, databases, and credentials. Cloudflare stated that no customer data was actually exposed and has since removed the problematic setting and cleared affected storage.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Cloudflare?
Get an email when a new story names Cloudflare, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe root cause of this vulnerability was a misconfigured shared storage pool that reused data blocks without clearing (zeroing) them between tenant allocations — a classic configuration management failure in multi-tenant environments. This meant one customer's container could read residual data left behind by another customer, including sensitive artifacts like directory listings, databases, and credentials. In cloud and shared infrastructure environments, proper memory and storage sanitization between tenant workloads is a fundamental security requirement, not an optional hardening step. While Cloudflare confirmed no actual data exposure occurred, the potential blast radius — credential theft, lateral movement, and data breaches across customer boundaries — underscores how infrastructure-level misconfigurations can completely undermine tenant isolation guarantees. This incident is a reminder that multi-tenant security is only as strong as the least-sanitized shared resource.
What helps against this
How we list vendors- Vulnerability scanning and prioritisation
You know which systems are vulnerable, and which ones to fix first.
- Cloud security posture management (CSPM and CNAPP)
Misconfigured cloud storage and over-permissive roles get caught before they leak.
- Encryption and key management
Stolen data stays unreadable, and the keys stay under your control.