● Covered by 1 source · 1 reportMedium impact1 neutral
Cloudflare remediates cross-tenant data exposure vulnerability in Containers
Key points
- Vulnerability reported by Oren Yomtov on September 4, 2026.
- Affected Cloudflare Containers and Sandboxes services.
- Allowed recovery of residual 64 KiB disk blocks from other tenants.
- Cloudflare remediated the issue; no evidence of malicious exploitation.
Vulnerability Discovery and Reporting
On September 4, 2026, security researcher Oren Yomtov from Accomplish reported a vulnerability to Cloudflare through its bug bounty program. The vulnerability affected Cloudflare Containers and Cloudflare Sandboxes, which is built on Containers. Cloudflare collaborated with Yomtov and the Accomplish security research team to validate the issue and respond.
Nature of the Vulnerability
The vulnerability allowed a customer with a Workers Paid account to recover residual 64 KiB disk blocks previously used by other Containers on the same host. This was possible because Cloudflare Containers use Linux device mapper thin provisioning (dm-thin) with the 'skip_block_zeroing' option enabled. When a thin volume backing a container's root disk was deleted, its physical blocks were returned to a shared pool without being zeroed, making their previous contents potentially recoverable upon reassignment.
Potential Impact and Limitations
The technique could not target a specific customer, workload, host, or data, and the presence of residual data was not guaranteed. Cloudflare operates multi-tenant infrastructure where workloads are automatically assigned to eligible servers, preventing customers from selecting underlying hosts. While a data exposure was possible, Cloudflare found no evidence that customer data was compromised maliciously.
Remediation and Investigation
Cloudflare applied a fix across its entire Containers fleet, which did not require any customer-side configuration changes. An investigation of historical disk-I/O telemetry revealed no evidence of malicious exploitation. All activity attributable to the reported technique came from the researchers and Cloudflare engineers conducting authorized validation.
✨ This summary was generated by AI from the outlets' reporting listed below. It is not independently verified and may contain errors — check the original sources. How BrevFeed works →
The daily brief
One email each morning: the day's tech stories, clustered across outlets and summarized. No account needed.
One email a day. Unsubscribe in one click, any time.
Today's brief
Spend a few minutes, get the whole day. Every topic's top stories in one hands-free rundown — listen, watch, or read the transcript.
▶ Play today's brief
New every morning, and the back catalogue is archived by date.
Primary sources
CVE CVE-2023-503877.5 HIGHReporting from
Cloudflare fixed a vulnerability in its Containers and Sandboxes services that could have exposed residual disk blocks from other tenants. A security researcher reported the issue, which allowed Workers Paid account users to potentially recover data from previously used storage blocks on the same host. Cloudflare found no evidence of malicious exploitation and applied a fix across its Container fleet.