Cloudflare Resolves Cross-Tenant Data Exposure Vulnerability in Cloudflare Containers
Cloudflare has patched a security vulnerability in Cloudflare Containers that could have allowed cross-tenant data exposure through residual disk data from previous workloads. The issue was discovered by external researchers at Accomplish and mitigated immediately by Cloudflare's engineering teams.
External security researchers at Accomplish identified a critical vulnerability in Cloudflare Containers that could expose residual disk data to subsequent workloads running on the same host. The vulnerability stemmed from how container block storage and temporary filesystems were managed, potentially letting new container instances read uncleared data left behind by deleted or terminated containers of other tenants. Upon receiving the report, Cloudflare's security and engineering teams launched an investigation to determine the blast radius and remediate the issue. They confirmed that the vulnerability could allow a malicious tenant to access residual data, though there was no evidence of active exploitation in the wild prior to the fix. To resolve the issue, Cloudflare implemented immediate patches to guarantee block storage volume zeroing and secure teardown procedures for container filesystems. This ensures all disk blocks are thoroughly wiped before being reassigned to any new container workloads, successfully preventing cross-tenant data leaks.
Primary source
Open Cloudflare Blog ↗This article summarizes the source. Check the original for full details and conditions.
Comparison
| Aspect | Before / Alternative | After / This |
|---|---|---|
| Volume Deallocation | Potential for uncleared disk blocks to remain accessible to subsequent workloads on the same host | Mandatory zero-filling of all storage blocks upon container teardown |
| Cross-tenant Isolation | Logical isolation susceptible to residual disk exposure on shared hardware | Strict block-level isolation with sanitized storage provisioning |
| Data Exposure Risk | High risk of leakage of sensitive files or environment variables left on disk | Zero risk of residual data exposure from prior container lifecycles |
Action Checklist
- Review Cloudflare Container deployment logs for unexpected access patterns Focus on the timeframe prior to the remediation release
- Rotate sensitive credentials that may have been stored as plain files within the container filesystem As a best practice, transition to secure secrets management
- Verify container configurations utilize secure environment variables instead of disk storage for secrets This reduces the threat surface of any potential local file inclusion or data remnant issues
