Cloudflare patches flaw allowing access to leftover customer disk data

Cloudflare has patched a security flaw in its Containers and Sandboxes services that allowed users to access leftover disk data from previous customers. The vulnerability stemmed from how shared disks were configured using Linux thin provisioning. When a container was deleted, its storage blocks were returned to a shared pool without being wiped, allowing new containers to potentially read residual data from the previous occupant.

Researchers from the security firm Accomplish discovered the issue and reported it through Cloudflare’s bug bounty program. During testing, researchers found leftover material—including directory structures, database pages, and SQLite databases—on a significant portion of tested machines across four continents.

Cloudflare stated that the data accessed was not from live workloads and that attackers could not specifically target a particular customer's data. The company has implemented a fix across its service and noted that customers do not need to take any action.