Researchers exploited Cloudflare Containers flaw to read other tenants' residual disk data
matthew_d_green · x · 2026-09-24
Accomplish AI researcher Oren Yomtov responsibly disclosed a cross-tenant data exposure vulnerability in Cloudflare Containers: on multi-tenant hosts, a customer with a Workers Paid account could recover residual disk blocks left by previous workloads, including SQLite databases, Chromium profiles, and .env files. Cloudflare Sandboxes and Browser Rendering, built on the same disk implementation, were also affected.
Key points:
- The technique could not target specific customers, workloads, hosts, or data, and residual data was not guaranteed to be present
- Cloudflare has fully remediated the issue fleet-wide with no customer-side changes required
- Disk-I/O telemetry showed no evidence of malicious exploitation; all attributable activity came from researchers and authorized validation
- Cloudflare published a detailed technical postmortem on its official blog
Related event: Cloudflare Patches Cross-Tenant Data Leak in Containers(4 posts)→
More from Infra
- UK Sovereign AI invests in Fractile to build next-gen frontier AI chips — charlieharris01 · 2026-11-11
- What happened when I moved vector retrieval into Snowflake SQL instead of orchestrating RAG outside — dima806_dima · 2026-11-11
- AI chip startup Fractile raises $720M Series C for DRAM-on-processor design — Tom_Westgarth15 · 2026-11-11
- Mobile AI Factory: agentic pipeline builds on-device SLMs that beat 5-shot frontier models — kalyan_kpl · 2026-11-11
- Vivo's Starlink direct-to-cell service hits 10M users in two weeks across Brazil — XFreeze · 2026-11-11
- Nan Ya Plastics to spend NT$11.53B on fifth glass fabric plant on AI server demand — zephyr_z9 · 2026-11-11