Cloudflare Containers Cross‑Tenant Data Exposure Vulnerability Fixed
What Happened — Cloudflare disclosed a flaw in its Containers and Sandboxes service that allowed a paid‑account user to read residual data from other customers’ containers on the same physical host. The issue stemmed from a shared storage pool that skipped zeroing reused 64 KiB blocks, leaving up to 60 KiB of prior tenant data readable. Cloudflare patched the configuration and retired existing container disks.
Why It Matters for Trust & Control Assurance
- The incident tests the control objective of tenant isolation and data segregation – a core requirement for any multi‑tenant cloud service.
- Continuous control‑assurance programs need verifiable evidence that storage sanitization and logical separation are enforced at scale.
- Mapping this finding to a single control area demonstrates how one objective satisfies multiple framework requirements (e.g., NIST CSF, ISO 27001, SOC 2).
Who Is Affected — SaaS developers, cloud‑native applications, and any organization running workloads on Cloudflare’s Workers Paid plan (broadly technology and cloud‑infra sectors).
Recommended Actions
- Verify with your cloud provider that storage block zeroing is enforced for all multi‑tenant workloads.
- Incorporate storage‑sanitization checks into your continuous control‑monitoring pipeline.
- Collect and retain evidence of remediation (e.g., configuration snapshots, audit logs) to support audit readiness. Source: BleepingComputer
Technical Notes — The vulnerability was reported via HackerOne on 4 Sept 2026. Exploitation required writing a 4 KiB payload to an unused region of a new container’s disk, exposing residual data from prior containers on the same host. No active data was read or altered in the disclosed tests. Mitigation involved removing the “skip zeroing” setting and clearing cached snapshots. Source: BleepingComputer