Cloudflare Fixes Flaw That Let One Container Read Another Customer's Leftover Disk Data
Cloudflare fixes flaw allowing one container to read another customer's leftover disk data.
A vulnerability in Cloudflare Containers allowed one customer's container to access residual data left on shared disk space by previous containers. The issue stemmed from thin provisioning in Linux, where disk blocks were not wiped before being reallocated. While the data was not from live workloads and attackers couldn't target specific customers, researchers found leftover directory structures, database pages, and credential files. Cloudflare has since fixed the flaw by re-enabling block wiping and clearing affected server caches, and found no evidence of exploitation.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Cloudflare?
Get an email when a new story names Cloudflare, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe vulnerability arose from a misconfiguration in Cloudflare's container infrastructure where thin-provisioned Linux disk blocks were not wiped before being reallocated to new customer containers. This meant leftover artifacts — including directory structures, database pages, and credential files — from previous workloads were potentially readable by subsequent tenants. In multi-tenant cloud environments, improper resource recycling can break critical isolation boundaries even without active exploitation. This incident highlights that secure defaults (such as block wiping) must be explicitly verified and tested, not assumed, especially when performance optimizations are applied. The potential exposure of credential files underscores how even 'residual' data can carry serious confidentiality risk.
What helps against this
How we list vendors
- Cloud security posture management (CSPM and CNAPP)
Misconfigured cloud storage and over-permissive roles get caught before they leak.
- Encryption and key management
Stolen data stays unreadable, and the keys stay under your control.
- Immutable backup and recovery
Ransomware cannot delete or encrypt your way back.