Loading story…
Cloudflare remediated a cross-tenant data-disclosure flaw in Cloudflare Containers and Cloudflare Sandboxes after Oren Yomtov of Accomplish responsibly reported it on September 4. Linux dm-thin storage pools had been configured with skip_block_zeroing, allowing a newly allocated 64 KiB block to retain as much as 60 KiB of data from a deleted container after a 4 KiB write. A Workers Paid customer could potentially recover residual filesystem metadata, database pages, or application data from a prior workload sharing the same host.
An attacker could not select a target tenant, host, or active disk, limiting the exposure to remnants on previously used storage. Cloudflare removed the unsafe storage configuration, retired and recreated existing disks and cached snapshots, and completed fleet cleanup on September 19. The company said it found no evidence of malicious exploitation or customer data compromise.
See affected versions and whether adversaries are exploiting it.
4 events from the most recent confirmed update back to the earliest known activity.
Cloudflare completed cleanup of cached dm-thin snapshots created before mitigation, after draining hosts, restarting virtual machines, clearing image caches, and recreating disks and cached layers with zeroed allocations.
The researchers independently confirmed that their proof of concept no longer functioned after Cloudflare's runtime mitigation.
Cloudflare completed rollout of a configuration change removing dm-thin's unsafe skip_block_zeroing setting across its Containers fleet, restoring zeroing of newly allocated blocks.
Oren Yomtov of Accomplish responsibly reported a cross-tenant data-disclosure vulnerability in Cloudflare Containers and Cloudflare Sandboxes through Cloudflare's HackerOne program. The flaw could expose residual data from previously deleted container volumes when reused dm-thin blocks were not zeroed.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
reddit.com
Open sourceblog.cloudflare.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported a chain of vulnerabilities in **Cloudflare Pages** build infrastructure that enabled command injection through user-controlled build settings, exposing sensitive pipeline variables including a GitHub private key for the Pages integration application and Cloudflare API credentials. The key reportedly carried read/write access to repositories for 18,290 users that had authorized the app. Subsequent findings included a world-writable binary, `PATH` hijacking, Azure DevOps variable injection, and passwordless `sudo` for the pipeline user; from a container, accessible Docker socket access allegedly allowed creation of a privileged container and recovery of Azure DevOps tokens used to enumerate Pages projects and build history. After Cloudflare re-architected the environment around GKE and gVisor, researchers found that build containers could still reach Kubernetes host services. An unauthenticated kubelet API on TCP port `10255` exposed `/pods` data, including pod environment variables such as `GIT_CREDS`; scanning the `10.124.0.0/16` range identified multiple similarly exposed hosts, creating potential cross-tenant credential exposure. Cloudflare reportedly remediated the command-injection issue within two days and later implemented network isolation to prevent pod-to-host communication, an essential control where Kubernetes NetworkPolicy-capable networking is used to restrict L3/L4 ingress and egress paths.
Sep 3, 2026
Researchers disclosed a remote **Spectre** attack against **Cloudflare Workers** that extracted a JSON Web Token from a co-located Worker running in Cloudflare’s production environment at up to **12 bits per second**. The attack targeted separate **V8 isolates** sharing the same process, using WebSocket communications as a remote timing source and long-lived **Durable Objects** to bypass assumptions in Cloudflare’s Dynamic Process Isolation (`DyPrIs`) design. Testing reportedly succeeded on Linux servers with AMD EPYC Zen 2 and Zen 3 processors, with lower system load improving leakage rates while slower exfiltration remained possible under heavier load. Cloudflare said the research did **not** access customer data and that it found no signs of active exploitation during the past three years, but acknowledged limitations in its production isolation model and detailed hardening steps. The company said it mitigated the issue by improving `DyPrIs`, integrating the **V8 Sandbox**, and deploying **MPK-based in-process isolation** to better contain speculative-execution attacks in multi-tenant Worker environments. The disclosure highlights that speculative side-channel risks can persist even in sandboxed serverless platforms when attacker and victim workloads are co-located within the same process.
Aug 22, 2026
The containerd project released patches for five vulnerabilities in its CRI and image-handling components, including three **critical** flaws tracked as `CVE-2026-50195`, `CVE-2026-53488`, and `CVE-2026-53492`, alongside `CVE-2026-53489` and `CVE-2026-47262`. According to the project’s disclosure and an AWS security bulletin, the bugs could let attackers poison a node’s local image cache with crafted checkpoint images, pass unvalidated image labels that may lead to arbitrary host command execution through label-consuming plugins, and abuse untrusted CDI annotations during checkpoint restore to bypass Kubernetes device allocation controls. The remaining issues include a **high-severity** arbitrary host file-read path through `kubectl logs` by restoring a symlinked `container.log` from a checkpoint image, and a **moderate** denial-of-service flaw that can exhaust memory and crash the `containerd` process. Fixes are available in containerd `2.3.2`, `2.2.5`, and `2.1.9` for all five vulnerabilities, while versions `2.0.10` and `1.7.33` address `CVE-2026-53488` and `CVE-2026-47262`; maintainers urged immediate upgrades and said containers restored from untrusted checkpoints may need to be recreated to remove smuggled CDI configuration tied to `CVE-2026-53492`.
Jul 1, 2026