Cloudflare Containers Vulnerability: How One Customer Could Read Another's Leftover Data

In September 2026, Cloudflare disclosed a flaw in its Workers platform that allowed containers to read unallocated disk space left behind by other customers' workloads on the same physical server. A security researcher discovered that when a container finished its execution and released its resources, Cloudflare did not immediately wipe the disk sectors it had occupied. A subsequent container running on the same hardware could then access that leftover data before Cloudflare provisioned the space to the next user. Cloudflare confirmed the flaw and released a patch, stating that the window for exploitation was narrow and that no evidence of real-world abuse had been detected.

Crucially, the flaw did not expose live workloads or active data in use by other customers. The vulnerability only affected disk sectors that containers had already relinquished. An attacker could not choose whose data they accessed; they would encounter whatever residual data happened to occupy the physical space their container was assigned.

Cloudflare Containers and similar serverless platforms run thousands of customers' code on the same servers to maximize efficiency and keep pricing competitive. That density creates a trust boundary: your code must never be able to read, modify or infer anything about a competitor's, a customer's, or another tenant's data. When those boundaries slip, even in a limited way, it exposes a fundamental anxiety about cloud infrastructure: that the vendor's isolation mechanisms are not as airtight as the contract promises.

In this case, the risk was real but bounded. The data was old and unallocated, not actively used. However, it illustrates a pattern that security researchers and compliance auditors watch closely: data residue from previous workloads, combined with weak or delayed cleanup routines, can become a side channel. Sensitive configuration values, API keys, database connection strings or customer PII from a previous container might persist in memory or on disk for longer than expected.

Serverless platforms allocate disk resources to containers dynamically. When a container finishes execution and is torn down, the platform must reclaim that disk space and prepare it for the next workload. The gap between when one container releases its data and when the platform explicitly zeros or deallocates that space is where the risk lived.

A malicious tenant could deploy code that, after performing its legitimate work, attempted to read the file system looking for leftover data in unallocated regions. In most cases, the container would find random junk or fragmentary old data. But if another customer's container had recently run on the same hardware and had written sensitive information to disk (logs, temporary files, cache), portions of it might still be readable before the platform's garbage collection or security cleanup routines ran.

The flaw relied on two conditions: the container needed to have read access to unallocated disk sectors (normally, containers cannot do this), and the platform needed to delay or skip cleanup between container terminations. Cloudflare's implementation exposed both.

Multi-tenant infrastructure vulnerabilities of this kind have appeared before in other cloud providers. AWS, Google Cloud and Azure have all patched similar issues in their early years, such as side-channel reads of memory from previous EC2 instances or Compute Engine VMs. These findings are rarely exploited in the wild because they require specific knowledge of a provider's architecture, and the attacker's reward is unpredictable. However, they are high-severity in compliance and regulatory contexts: a healthcare provider or financial services company running sensitive workloads on shared infrastructure needs absolute confidence that no residual data leaks across tenant boundaries.

Security researchers at academic institutions and specialized firms such as Tal Be'ery and others have documented that disk and memory residue is harder to eliminate than most vendors assume, especially in virtualized and containerized environments where workloads are ephemeral. The lesson is that cleanup must be explicit, mandatory and verified, not a best-effort background task.

Cloudflare's patch ensured that container disk sectors are cryptographically wiped or marked as inaccessible before they are reallocated to new tenants. The exact mechanism has not been fully disclosed, but standard approaches include zeroing memory and disk blocks, using encrypted containers with per-workload keys that prevent reading old data, or enforcing mandatory delays between container destruction and space reuse.

The company also updated its monitoring to detect anomalous reads of unallocated space, alerting engineers if containers attempt to access regions they should not. This detection layer serves two purposes: it catches exploitation attempts and it catches remaining gaps in the vendor's own cleanup logic.

For customers running sensitive workloads on Cloudflare Workers or similar platforms, the immediate action is to update to the latest version and verify that the patch has been applied to your account. You can check Cloudflare's security advisory page or contact support to confirm the status.

Beyond that, assume that any shared infrastructure has some residual risk of data leakage, no matter how well-engineered. If you must run highly sensitive code (processing payment data, health records or secrets), consider the following:

1. Avoid writing sensitive data to disk if possible. Use memory-only operations.

1. If you must write sensitive data, encrypt it with a key that exists only during the container's lifetime and is destroyed when the container terminates.

1. Use a dedicated or isolated tier of infrastructure for the highest-sensitivity workloads, accepting higher cost and longer latency in exchange for a smaller attack surface.

1. Regularly audit and rotate any secrets or credentials that your containers have access to, so that old data residue has a shorter useful lifetime.

1. When choosing a cloud provider, ask explicitly about their data cleanup policies, request their security audit reports (SOC 2, ISO 27001), and check their vulnerability disclosure record.

Cloudflare's response to this flaw was professionally handled: they coordinated with researchers, disclosed the issue openly, patched it promptly and provided guidance to customers. That does not eliminate the underlying risk, but it shows the vendor takes the problem seriously.

This vulnerability underscores that no cloud platform is immune to multi-tenant isolation flaws, and vendors' cleanup and security practices are not always visible to customers. The flaw was not catastrophic: it affected a narrow window, involved unallocated data, and had no known exploitation. Yet it was real enough that researchers found it and users deserved to know about it.

If you operate infrastructure or store data in shared cloud environments, make verification of isolation and cleanup practices part of your vendor evaluation. Ask for security audit reports, incident histories and specific details about how the provider handles data residue. Do not assume that encryption at rest or access controls alone protect you; the gap between when one tenant releases data and when another tenant accesses it is where trust becomes technical obligation.

Start today: if your organization uses Cloudflare Workers or similar serverless services, pull up your vendor's security advisories page and check whether this patch has been applied to your account and workloads.

Can an attacker specifically target my data with this flaw.

No. The vulnerability only exposed unallocated disk sectors that happened to be assigned to an attacker's container. The attacker could not choose whose data they accessed; they would find whatever residual data remained from previous containers.

Was my data actively being read by hackers.

Cloudflare stated that no evidence of real-world exploitation had been detected. The flaw required specific knowledge of the platform's architecture and was limited to old data that had already been released by other containers, making it an unlikely target for opportunistic attacks.

Does this mean I should leave Cloudflare.

No. This flaw was identified, disclosed and patched. Cloudflare's response was transparent and timely. All cloud providers face similar isolation challenges; the question is how quickly and openly they address them. Cloudflare demonstrated responsible handling here.

What kinds of data could have been exposed.

Theoretically, any data that previous containers had written to disk: logs, temporary files, configuration values, API keys or cached information. The likelihood of finding coherent sensitive data in unallocated sectors was low, but not impossible if another customer had recently run a workload that wrote secrets to disk.

Should I be encrypting all secrets before writing them to cloud storage.

Yes, as a general practice. Even with this flaw patched, encryption of sensitive data before it touches any external storage reduces your exposure if other isolation boundaries are compromised or if a future vulnerability emerges.

Source: The Hacker News