Cloudflare Fixes Flaw That Let One Customer's Container Read Another's Leftover Disk Data

A researcher with an ordinary paid Cloudflare account could read fragments of other customers' data straight off the disk. Cloudflare has fixed the cross-tenant flaw in its Containers and Sandboxes products, the services developers use to run arbitrary code, including untrusted code written by AI agents.

Oren Yomtov of Accomplish reported the bug through HackerOne on 4 September 2026. He did not need special access, only a Workers Paid account.

The problem sat in how Cloudflare carved up shared storage. Container disks came from Linux dm-thin pools shared by many tenants, which hand out space in 64 KiB blocks. Cloudflare had enabled skip_block_zeroing, a performance setting that skips wiping a block before giving it to a new owner.

That left a simple trick. Write 4 KiB into fresh space, then read the raw Firecracker disk at /dev/vdc, and the remaining 60 KiB or so of the block still held whatever the previous tenant left behind.

What came back was real customer data. The researchers found leftovers on 18 of 24 container placements and 20 of 22 nodes across four continents, including directory structures, database pages and SQLite files, The Hacker News reported.

The exposure had limits. An attacker could not choose a victim, could not touch another tenant's live workload and could not change anyone's active data. They got random scraps of whatever had previously used the same blocks.

Cloudflare turned block zeroing back on, which killed the proof of concept by 14 September. Because old residue could still sit on existing disks, it also retired every running container disk and cleared cached OCI image snapshots, finishing that cleanup on 19 September.

Customers do not need to do anything. Cloudflare says its retained disk I/O telemetry shows no sign that anyone other than the researchers exploited the bug.

It is a reminder that isolation in shared infrastructure often fails at the storage layer rather than the hypervisor. Cloudflare's product teams have been shipping fast, from post-quantum DNSSEC on 1.1.1.1 to sandboxes for agent code, and one performance flag was enough to let tenants read each other's leftovers.