Cloudflare Patches Cross-Tenant Leak from Unwiped Storage Blocks

Security researcher Arpit Bhayani detailed a cross-tenant data leak in Cloudflare Containers/Sandboxes, where deleted volumes were not zeroed before block reuse, leaving customer data in 18 of 24 test containers. Cloudflare has since fixed the vulnerability.

2026-09-28 ~ 2026-09-28 · 2 related posts

• Cloudflare incident: skipped block zeroing leaked tenant data across 18 of 24 containers — arpit_bhayani · 2026-09-28
• Cloudflare fixes cross-tenant flaw: unzeroed storage blocks leaked customer container data — arpit_bhayani · 2026-09-28