A shared‑disk vulnerability in Cloudflare Containers allowed one customer to read residual data from another, prompting a patch across the service.

Cloudflare has patched a critical vulnerability that allowed a malicious tenant to read leftover disk data from other customers sharing the same container infrastructure.

What the vulnerability entailed

The flaw stemmed from a shared‑disk implementation in Cloudflare’s multi‑tenant container platform. When a container was terminated, residual data remained on the underlying storage, which could be accessed by a newly provisioned container belonging to a different customer.

Security researchers demonstrated that by deploying a container and inspecting the disk, they could retrieve fragments of files left behind by a previous tenant, potentially exposing sensitive information such as configuration files, API keys, or private data.

How Cloudflare responded

Upon disclosure, Cloudflare’s engineering team quickly issued a hotfix that enforces strict data sanitization and isolation between container instances. The update includes automatic zero‑ing of storage blocks and tighter access controls to prevent cross‑tenant reads.

The company also announced a comprehensive review of its container orchestration logic and pledged to roll out additional hardening measures across all shared‑resource services.

Implications for customers

While no widespread data breaches have been reported, the incident highlights the risks inherent in multi‑tenant environments that rely on shared storage. Customers are advised to rotate any potentially exposed credentials and monitor for unusual activity.

  • Verify that secret keys and tokens are rotated regularly
  • Enable additional encryption for sensitive data at rest
  • Review container logs for unexpected access patterns

Cloudflare assures that the patched vulnerability does not affect its core CDN and DNS services, which continue to operate on separate, isolated infrastructure.

We take security very seriously and have acted swiftly to protect our users. – Cloudflare security team

For a detailed analysis of the flaw and Cloudflare’s remediation steps, see The Hacker News coverage of Cloudflare container vulnerability.