Cloudflare says it has fixed a cross-tenant data exposure vulnerability in Cloudflare Containers and Cloudflare Sandboxes after outside researchers showed that a new workload could recover residual disk blocks from a previous container on the same host.

The issue matters for hosting and application teams because Containers is part of Cloudflare’s developer platform for running customer workloads on shared infrastructure. In a post published September 24, Cloudflare said Oren Yomtov and the Accomplish security research team reported the bug through its bounty program on September 4. Cloudflare said the vulnerability has been remediated fleet-wide and that it has “no evidence that customer data has been compromised.”

According to Cloudflare, the affected configuration involved Linux device-mapper thin provisioning for container root disks. A storage-pool option that skipped block zeroing meant a partially written 64 KiB block could retain leftover bytes from a previous workload after the block was returned to the shared pool. The researchers’ proof of concept could not choose a specific customer, workload, host, or data set, and residual data was not guaranteed to be present, Cloudflare said.

For site operators, the practical takeaway is mostly about provider due diligence rather than emergency configuration. Cloudflare says it applied the fix without customer-side changes. Still, the incident is a useful reminder that managed container and serverless platforms are only as isolated as their storage lifecycle, snapshot, and block-scrubbing controls.

Teams using managed application hosting should review whether their vendors document tenant-isolation boundaries, incident disclosure processes, and customer notification criteria. Workloads that handle credentials, session data, or customer uploads should also keep secrets out of writable local disks where possible, rotate sensitive tokens after credible exposure windows, and prefer short-lived credentials.

Source: Cloudflare — “How Cloudflare addressed a cross-tenant data exposure vulnerability in Containers”.