Cloudflare disclosed and fixed a flaw that let a paying customer’s Container workload read leftover disk data from other customers’ containers that had previously run on the same physical server. Researcher Oren Yomtov of the security firm Accomplish reported the issue through Cloudflare’s HackerOne bug bounty program on September 4. The root cause was a configuration option in Cloudflare’s use of Linux device mapper thin provisioning, the mechanism that allocates disk space to containers on demand: when a small four-kilobyte write triggered allocation of a larger 64-kilobyte physical block, the remaining space could still hold data a prior tenant had written and released, rather than being zeroed out first.
Across 24 test placements on 22 different servers, Yomtov’s team recovered residual data on 18 of them, a 75 percent hit rate, and could not choose whose data they got. The recovered material included directory structures, database pages and structurally complete SQLite databases, the kind of files that routinely hold credentials, session tokens or customer records. Cloudflare Sandboxes, a product built on Containers and marketed as a safe environment for running untrusted code, including code generated by AI agents, was affected by the same underlying issue. Cloudflare says it removed the vulnerable configuration option within hours of the report, completed a fleet-wide rollout within three days, and finished clearing pre-mitigation disk caches by September 19. The company found no evidence of malicious exploitation and says no customer action is required.
The original insight worth carrying forward is what this does to the trust model of multi-tenant compute: a security boundary that depends on a storage layer zeroing freed blocks is invisible to the customer relying on it, and Cloudflare Sandboxes selling isolation for AI-agent-generated code raises the stakes on that invisible layer holding, echoing this desk’s coverage of a separate Linux kernel flaw letting VMs read host memory. Teams evaluating any shared container platform should ask vendors directly whether disk blocks are zeroed before reallocation across tenants, a question this incident shows is not safe to assume, and should revisit isolation assumptions for AI-agent tooling that executes untrusted code.
Source: Cloudflare
