Cloudflare fixes container flaw that exposed other customers’ leftover disk data

Cloudflare has fixed a flaw in its Containers service that let one paying customer read data left behind on shared disks by other customers’ containers. The company said the exposure came from disk space that earlier containers had used and released, not from any live workload, and that an attacker could not choose whose data they received.

The flaw was reported on September 4 by Oren Yomtov of the security firm Accomplish through Cloudflare’s bug bounty programme. It stemmed from thin-provisioned disks that allocate storage in 64-kilobyte blocks: when a container was deleted, its blocks returned to a pool shared across accounts, and that pool was set to skip wiping a block before reuse. Writing a small block into unused space and reading the whole block back at raw disk level recovered the previous container’s bytes.

Researchers reported finding leftover material on 18 of 24 production attempts and on 20 of 22 underlying machines across four continents, recovering directory structures, SQLite databases, browser profiles, .env files and credential files. Cloudflare turned wiping back on for newly handed-out blocks, then retired every running container disk and cleared image-layer caches, finishing on September 19 and disclosing five days later. It said it found no evidence the method was used by anyone else.