Cloudflare Fixes Flaw That Let One Container Read Another Customer's Leftover Disk Data

Summary: A flaw in Cloudflare Containers let a paying customer read leftover disk data from other customers' containers on the same shared server, and Cloudflare Sandboxes, which runs untrusted code including AI-agent code, was affected too. The flaw was reported September 4 by Oren Yomtov of Accomplish through Cloudflare's bug bounty program; Cloudflare turned block wiping back on, retired every running container disk and cleared image-layer caches, finished cleanup on September 19, and disclosed five days later.
What you should know: The researchers recovered directory structures, database pages, and structurally complete SQLite databases on 18 of 24 production tries, and Cloudflare's own detection found no other use only within the disk records it retained, without stating the time span or when the unsafe setting was first put in place.

Read the original at The Hacker News ↗

Topics: Vulnerabilities & Patching
Related: Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026
PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026