Cloudflare Patches Cross-Tenant Flaw That Exposed Un-Wiped Container Disk Data

Cloudflare fixed a vulnerability in its Containers and Sandboxes services that allowed users to read residual disk data left behind by other customers on shared servers. The underlying issue stemmed from shared disks skipping the default wipe process for 64KB blocks, allowing a new container that wrote a 4KB block to read the remaining 60KB of uncleared data at the raw disk level. Researchers from Accomplish successfully recovered directory structures, Chromium browser profiles, and credential files on 18 of 24 tries across 20 of 22 underlying machines. Cloudflare completely retired all running container disks and cleared server caches by September 19 to fully mitigate the hardware-level data exposure. The company stated its activity records showed no evidence of unauthorized exploitation by outside actors, though it did not disclose exactly when the unsafe configuration was initially implemented.