Cloudflare Fixes Security Vulnerability in Containers

On Thursday, Cloudflare announced a security vulnerability in its containers that enabled a paying customer to access data left by other customers on the same server. This data originated from storage space previously used and then released by earlier containers. According to Cloudflare, this did not involve data from active workloads, and an attacker could not choose whose data they received. The vulnerability was discovered by a team of researchers who classified it as critical. Cloudflare stated that the affected functionality in the containers allowed data that was not properly deleted to be viewed by new containers.

This could potentially include sensitive information left by previous users. To address the vulnerability, Cloudflare immediately implemented data sanitization measures and enhanced security protocols for the containers. The changes are intended to ensure that all data released by containers is completely deleted before new containers access the same storage space. Cloudflare emphasized that the vulnerability was not exploited before it was fixed. The company has informed its customers about the vulnerability and recommended that they review their security practices.

The researchers who discovered the vulnerability shared their findings with Cloudflare to enhance the platform's security. The vulnerability was not assigned a specific CVE number, suggesting that it may not have been considered widespread or critical enough to warrant such a classification. However, Cloudflare has assured that all necessary steps have been taken to ensure customer security. Incidents like this highlight the challenges faced by cloud services, particularly regarding data security and privacy. Companies using cloud services must be aware of the risks and take appropriate measures to protect their data.

Cloudflare has previously addressed several security vulnerabilities and continuously invests in improving its security infrastructure. Recent developments show that the company is proactively responding to security concerns and is committed to maintaining its customers' trust. The vulnerability was publicly disclosed on September 28, 2026, and Cloudflare plans to fully update the affected systems by the end of the month.