A cross-tenant leak in Cloudflare Containers? Here's the full story!

Hey everyone, it's me, Shii-chan! Today's topic is a bit tense: a security story.

Cloudflare Blog blog.cloudflare.com

What was announced?

On the Cloudflare blog, Cloudflare published a detailed account of a cross-tenant data exposure vulnerability that existed in Cloudflare Containers (and Sandboxes). It was reported by Oren Yomtov of the external security research firm Accomplish, through Cloudflare's HackerOne bug bounty program.

The root cause was a Linux device mapper thin provisioning (dm-thin) configuration option called skip_block_zeroing, which was enabled for container disks. Because of it, when a new container got allocated a 64 KiB disk block that a previous container had used, data the earlier tenant had written could remain readable unless the entire block was overwritten.

The research team demonstrated the issue by writing just 4 KiB into unallocated space and then reading the remaining 60 KiB back out.

Why it matters

Cross-tenant leakage in a container platform is a serious concern for any provider running multi-tenant infrastructure. When Cloudflare checked six production environments, they found 2,700 directory inodes that belonged to other tenants. In practice, this meant a Workers Paid account holder could potentially recover filesystem metadata, directory structures, or database contents generated by another customer's container on the same host.

That said, an attacker couldn't choose a specific victim to target, and the issue didn't affect active disks or workloads that were actually running.

What changes

Cloudflare took the following steps:

• Removed skip_block_zeroing from the dm-thin pool configuration, restoring the default, safer behavior
• Retired all container disks and cached snapshots created before the fix
• Rebooted affected hosts and cleared image caches

After analyzing disk I/O telemetry, Cloudflare found no evidence that this technique was used maliciously outside of the authorized testing done by the researchers and Cloudflare's own engineers. No action is required from customers.

Dive Deep

Cloudflare also published a timeline of the response:

• 2026-09-04 15:26 UTC: Vulnerability reported by Accomplish
• Same day, 23:15 UTC: Rollout of the fix to production begins
• 2026-09-07 06:13 UTC: Rollout complete, cleanup of residual data begins
• 2026-09-19 15:03 UTC: Fleet-wide cleanup complete

Less than eight hours passed between the report and the start of the production rollout.

Wrap-up

• A cross-tenant data exposure vulnerability in Cloudflare Containers was traced to the dm-thin skip_block_zeroing setting
• Reported by an Accomplish researcher via HackerOne; checking six environments turned up 2,700 inodes belonging to other tenants
• Cloudflare removed the setting, retired existing disks and snapshots, and rebooted affected hosts
• Telemetry analysis found no signs of malicious exploitation; no customer action is needed
• Worth a read if you're interested in multi-tenant infrastructure security or designing container platforms