Cloudflare Fixes Cross-Tenant Residual Data Exposure in Containers

Cloudflare remediated a cross-tenant data-disclosure flaw in Cloudflare Containers and Cloudflare Sandboxes after Oren Yomtov of Accomplish responsibly reported it on September 4. Linux dm-thin storage pools had been configured with skip_block_zeroing, allowing a newly allocated 64 KiB block to retain as much as 60 KiB of data from a deleted container after a 4 KiB write. A Workers Paid customer could potentially recover residual filesystem metadata, database pages, or application data from a prior workload sharing the same host.

An attacker could not select a target tenant, host, or active disk, limiting the exposure to remnants on previously used storage. Cloudflare removed the unsafe storage configuration, retired and recreated existing disks and cached snapshots, and completed fleet cleanup on September 19. The company said it found no evidence of malicious exploitation or customer data compromise.