Cloudflare Fixes Cross-Tenant Data Leak in Containers

1 reports archived1 independent sourcesupdated 10/18/2026, 16:25:33

Synthesis & Latest Updates

1 Sources Cross-Validated

Cloudflare disclosed and patched a cross-tenant data leak vulnerability in its Containers platform caused by misconfigured storage allocators. The issue stemmed from enabling skip_block_zeroing with mismatched block sizes, allowing new containers to read residual disk data from previous tenants, though no malicious exploitation was confirmed.

LATEST/Cloudflare disclosed and patched a cross-tenant data leak vulnerability in its Containers platform caused by misconfigured storage allocators. The issue stemmed from enabling skip_block_zeroing with mismatched block sizes, allowing new containers to read residual disk data from previous tenants, though no malicious exploitation was confirmed.

HEAT TRENDHourly heat curve

2 fully observed hours

Fewer than 3 fully observed hours; trend not plotted yet.

TIMELINECoverage timeline

Total 1 reports · Latest first

InfoQ 中文T2·Oct 18, 16:2568 pts
Cloudflare Fixes Cross-Tenant Data Leak in Containers
- The root cause lay in the Linux device mapper's thin provisioning configuration (dm-thin), not VM isolation failure.
- Enabling skip_block_zeroing with 64 KiB block sizes exposed unzeroed residual space to new tenants after small writes.
- Researchers successfully distinguished and recovered other users' historical data using ext4 directory block checksums, confirming the leak risk.
View Related Reports & Analysis Original Source