Cloudflare’s remediation efforts involved ensuring that every newly allocated block is cleared of all previous data before being exposed to a container. This action followed the discovery of a critical cross-tenant data exposure vulnerability within the platform’s container infrastructure, which is a cornerstone of its global multi-tenant services. The flaw was initially identified by security researcher Oren Yomtov of Accomplish, who reported the finding through the HackerOne bug bounty program on September 4, 2026. This vulnerability existed within the storage layer of the Cloudflare Containers environment, potentially allowing one user to access residual data from another tenant’s previous sessions. While the cloud provider maintains a robust defense-in-depth posture, the interaction between storage optimization and virtualization layers created an unexpected bridge for data leakage. This situation highlights how minor configuration choices can have vast security implications across a global fleet.
Technical Root Cause: The Danger of Storage Optimization
The technical root cause of the exposure was traced to the configuration of the Linux device mapper thin provisioning, commonly referred to as dm-thin, which manages the physical storage blocks for virtualized workloads. In its effort to provide high-performance compute capabilities, Cloudflare utilizes Firecracker microVMs to isolate container instances, where each container is provided a writable root disk as a specific device. To enhance the speed of disk operations, the platform had previously enabled the skip_block_zeroing option within the storage subsystem. Under normal operations with thin provisioning, storage is allocated in 64 KiB blocks only when the guest filesystem requires them. However, because the zeroing function was bypassed, when a container disk was deleted or reallocated, the underlying physical blocks were returned to the pool without being wiped. This allowed subsequent tenants to potentially see data belonging to previous users during their sessions.
Researchers demonstrated the severity of this flaw by executing a precise set of operations designed to capture recycled storage blocks from the host system. By intentionally writing small 4 KiB files into specific 64 KiB-aligned regions of a guest filesystem, they successfully triggered the allocation of blocks that had not been cleared. Upon reading the raw device immediately afterward, the researchers could view the remaining 60 KiB of residual data that had stayed intact from the previous tenant’s session. During their testing in various production environments, this opportunistic extraction method revealed highly sensitive information, including internal directory structures, fragments of database pages, and even entire SQLite databases. While the extraction was somewhat randomized based on block allocation patterns, the high density of global traffic meant that the probability of capturing useful data remained a significant concern for the security team and the broader organization.
Strategic Remediation: Securing the Global Infrastructure
To fully remediate the issue and ensure no residual risk remained, the engineering teams executed a series of aggressive infrastructure updates across the entire global fleet. Beyond merely disabling the skip_block_zeroing setting, the company had to address the data that might still be residing in existing disks and image caches. This involved a coordinated effort to drain hosts of active workloads, retire current virtual disks, and restart virtual machines to ensure all new allocations occurred under the new, secure parameters. This process was managed through an automated rollout to prevent service disruptions while simultaneously purging any uncleared blocks from the active pool. By re-enabling the zeroing of blocks at the kernel level, the platform ensured that every storage request by a container starts with a clean slate, effectively closing the side channel. This systemic cleanup was essential for maintaining the high standards of isolation expected in modern cloud environments globally.
The resolution of this storage exposure incident provided a critical lesson in the ongoing management of high-performance cloud architectures where isolation boundaries are constantly tested. For organizations operating within these shared environments, the primary takeaway involved the necessity of validating low-level storage configurations against potential data leakage. Although Cloudflare confirmed that no customer data was compromised by third parties, the company suggested that security teams consider rotating sensitive credentials as a precautionary measure to align with best practices. Moving forward, the implementation of more granular I/O monitoring and the adoption of zero-trust storage principles became a priority for infrastructure providers. Analysts emphasized that as cloud providers continue to optimize for speed, the security community must remain vigilant in auditing the underlying subsystems that govern resource sharing. These steps ensured that the platform evolved to withstand increasingly hardware-level attacks.
