A paying Cloudflare customer could read bytes left on shared disks by other tenants’ containers. The company has now closed the bug, and it says customers need take no action.
The flaw lived in the way shared storage was assembled. Disks relied on thin provisioning, a Linux technique that hands out space in 64-kilobyte chunks. Delete a container and those chunks flow back into a pool that spans accounts. One setting was wrong: the pool skipped the normal step of erasing a chunk before the next tenant received it. Oren Yomtov of the security firm Accomplish reported the issue on September 4.
What a tenant wrote was only part of what it could read. Because the stale bytes survived, anything written after the handover exposed the remainder of the block. The proof of concept was minimal: a few kilobytes written, then the whole block pulled back from the raw device. The untouched tail held an earlier tenant’s data. Production testing surfaced leftovers in 18 of 24 tries.
The recovered material included directory structures and structurally complete SQLite databases, plus browser profiles, environment files and credential files. Cloudflare Sandboxes, sold as a safe place to run untrusted AI-generated code, ran on the same system. An attacker could not choose whose data they received.
Cloudflare re-enabled block wiping first, then retired every running container disk and cleared cached image layers, draining and restarting servers during quiet hours. Its log review found no use of the method beyond authorized testing.
