Cloudflare Fixes Container Disk Flaw That Exposed Leftover Customer Data
Summary
A flaw in Cloudflare Containers let a customer read leftover data from other customers’ deleted containers on shared servers. Cloudflare fixed Containers and Sandboxes, cleared affected disks and caches, and found no evidence of other use.
Key points
- Shared disk blocks were returned to a cross-customer pool without being wiped before reuse.
- Researchers read residual data by writing 4 KB to an unused area and then reading the full 64 KB block.
- Recovered material included directory structures, SQLite data, browser profiles, environment files, and credentials.
- Cloudflare Containers and Sandboxes were affected; Cloudflare said customers need take no action.
- Cloudflare re-enabled wiping, then retired running container disks and cleared prepared-image caches; cleanup finished September 19.
- Cloudflare said its review of retained disk-activity records found no evidence of use beyond the researchers’ and its own authorized testing.
Article Details
- Vulnerability Types
- Cross-customer exposure of residual data in reused disk blocks
- Exploitation Status
- not_reported
- Exploit Availability
- unknown
- Patch Status
- available
People
Vendors
Products
Browser RunThe researchers, who separately say the same disk setup affected Cloudflare’s Browser Run product, described the flaw as their sixth escape from a code sandbox published since July, after findings in Anthropic’s ClaudeCloudflare ContainersA flaw in Cloudflare Containers allowed one customer to read leftover data from disks previously used by other customers’ containers on the same server.Cloudflare SandboxesCloudflare Sandboxes was also affected because it runs on Containers.