Cloudflare fixes cross-tenant flaw that exposed recycled container data

Cloudflare says it fixed a vulnerability in its Containers and Sandboxes services that could have allowed one customer to recover residual data from storage blocks previously used by another customer on the same host. The company says it found no evidence of malicious exploitation beyond authorised testing by security researchers.

Watch Desk analysis

What happened

Security researcher Oren Yomtov of Accomplish reported the issue to Cloudflare. The flaw affected Workers Paid customers and arose because a Linux device-mapper thin-provisioning configuration had disabled block zeroing. In plain English, recycled 64 KB disk blocks could retain fragments of data from an earlier container instead of being wiped before reuse.

Cloudflare says it re-enabled block wiping, retired running container disks and cleared caches. It also examined historical disk-I/O telemetry and says that review found no evidence of abuse beyond testing by the researchers and Cloudflare engineers.

The company’s technical account of the incident describes the exposure and remediation. The account does not say that customer data was actually recovered by an attacker.

Why it matters

This is the unglamorous but important side of cloud computing: isolation is not only about permissions and software boundaries. It is also about what happens to the physical or virtual storage underneath when one workload ends and another begins.

A failure to wipe recycled blocks can turn a boundary that looks secure in configuration into a privacy problem in practice. The reported scope is limited to residual storage data, but the underlying lesson applies across hosted containers, sandboxes and other multi-tenant systems.

Our read

Cloudflare’s remediation is reassuring, and its telemetry review gives the incident a useful boundary: this was a serious exposure, not a confirmed breach by an unknown attacker. That distinction matters. So does the fact that the fix involved both changing the storage configuration and retiring existing disks, rather than merely publishing a patch and hoping the old state would politely disappear.

Cloud customers should ask providers how recycled storage is wiped, how long old disks remain in service and what telemetry exists to investigate possible access. “Multi-tenant” is an architecture, not a magic spell.

What to watch

• Whether Cloudflare identifies any additional affected products or customer configurations.
• Whether independent researchers find similar block-zeroing problems in other container platforms.
• What Cloudflare’s telemetry review can and cannot detect about historical access.
• Whether cloud providers make storage sanitisation details more visible to customers. Sources and evidence: Cloudflare’s incident account, published 24 September 2026. The vulnerability details, remediation and exploitation assessment above are attributed to Cloudflare’s account, which says the issue was reported by Accomplish researcher Oren Yomtov.

Discussion spark: Should cloud providers be expected to publish their storage-sanitisation design and telemetry practices by default, or would that reveal more operational detail than customers need?

Watch Desk is operated by WittyWires as an independent cross-cutting AI news tracker. It does not speak for the organisations or people it covers.