# Cloudflare Containers exposed previous tenants’ disk data through unzeroed blocks Cloudflare has disclosed a cross-tenant data exposure flaw in Containers and Sandboxes: reused dm-thin storage blocks were handed to new workloads without being zeroed, letting a paying customer recover residual data from previous tenants on the same host. This was not a Firecracker escape or access to a live victim disk. It was a storage-isolation failure underneath the sandbox: researchers recovered foreign directory structures, database pages and complete SQLite databases from reused blocks, and Cloudflare had to fix allocation plus retire existing disks and cached snapshots. - Status: Active - Published: 2026-09-25T21:05:53+12:00 - Updated: 2026-09-25T21:05:53+12:00 - Categories: Cloud & Infrastructure, Cloud Platforms, Compute & AI Infrastructure - Tags: Cloudflare, containers, multi-tenancy, sandboxing, security - Canonical HTML: https://beyondthe.news/dossiers/cloudflare-containers-cross-tenant-residual-disk-data-sandboxes ## What changed On September 24, 2026 Cloudflare disclosed a vulnerability reported by Oren Yomtov of Accomplish on September 4. Cloudflare Containers used Linux dm-thin pools with skip_block_zeroing enabled. A new container could write 4 KiB into a newly allocated 64 KiB block and then read the remaining 60 KiB, which could still contain bytes from a previous tenant. Cloudflare says Sandboxes, which is built on Containers, was affected. The fleet was fixed and old mapped disks and cached image snapshots were retired by September 19. ## Why it matters The failure sits below the application sandbox boundary. A workload could be correctly isolated by Firecracker yet still receive storage containing another tenant's residual bytes. That matters especially for platforms running untrusted or AI-generated code: filesystem isolation, ephemeral disks and VM boundaries do not guarantee confidentiality if the underlying allocator reuses blocks without sanitising them. ## A 4 KiB write could expose 60 KiB of old tenant data The affected pools used 64 KiB dm-thin blocks and skip_block_zeroing. Researchers wrote one aligned 4 KiB block into unused filesystem regions, triggering allocation of a recycled physical block. Their subsequent raw-device read could expose the untouched 60 KiB remainder. ## The researchers found real foreign filesystem material Across production placements, Accomplish reported residual material on 18 of 24 placements and 20 of 22 underlying nodes across four continents. Cloudflare says recovered block types included directory structures, database pages and structurally complete SQLite databases. The researchers used ext4 checksums to distinguish foreign blocks from their own test filesystem. ## Turning zeroing back on was only the first fix Cloudflare removed skip_block_zeroing, but already mapped blocks and cached OCI image-layer snapshots could still contain pre-mitigation bytes. The company therefore retired running container disks, drained and restarted hosts and cleared image caches, completing cleanup on September 19. ## Cloudflare found no evidence of malicious exploitation Cloudflare built detection signatures from the proof of concept and searched the historical disk-I/O telemetry it retained. It says the only matching activity was authorized researcher and internal validation traffic. The disclosed telemetry window is not a guarantee that the flaw was never exploited outside the retained records. ## Key details - The issue was reported September 4, 2026 and publicly disclosed September 24. - Cloudflare Containers and Cloudflare Sandboxes were confirmed affected. - The root cause was dm-thin storage configured with skip_block_zeroing. - A 4 KiB write into a reused 64 KiB block could leave up to 60 KiB of previous data readable. - Researchers observed residual material on 18 of 24 placements and 20 of 22 underlying nodes across four continents. - Cloudflare completed fleet cleanup on September 19 and says customers need no configuration change. - Cloudflare says retained telemetry showed no malicious exploitation. ## Builder takeaways - Treat storage sanitisation as part of tenant isolation, not merely a disk-management detail. - If you operate multi-tenant ephemeral compute, verify what the block layer does when physical extents are returned to a shared pool and reallocated. - Do not assume VM or container isolation prevents data remanence from lower storage layers. - Secrets written to short-lived agent sandboxes can remain sensitive after the workload is destroyed; minimise secret exposure and lifetime even in supposedly disposable environments. - Test cached base layers, snapshots and already-mapped volumes when fixing allocator-level data-remanence bugs; changing future allocation behaviour may not clean historical mappings. ## What to watch - Whether Cloudflare or Accomplish publishes a precise affected-version or exposure-start window. - Whether Browser Run is formally added to Cloudflare's affected-product disclosure; Accomplish says the same disk setup affected it, while Cloudflare's post names Containers and Sandboxes. - Whether other multi-tenant sandbox providers audit thin-provisioned storage for comparable data-remanence behaviour. - Any evidence that the technique was exploited outside the retained telemetry Cloudflare examined. ## Uncertainties - Cloudflare did not state how long the unsafe storage configuration had been enabled or the full retention window of the telemetry used for its exploitation search. - Cloudflare's disclosure names Containers and Sandboxes; independent reporting says Accomplish also identified Browser Run as affected, so that product scope remains less firmly established. - The technique could not target a particular victim, host or active disk, and residual data was not guaranteed on any allocation. ## Sources - [How Cloudflare addressed a cross-tenant data exposure vulnerability in Containers](https://blog.cloudflare.com/containers-cross-tenant-vulnerability/) — Cloudflare · primary disclosure · 2026-09-24T00:00:00+12:00. Primary technical disclosure, impact, remediation and timeline. - [Cloudflare Fixes Flaw That Let One Container Read Another Customer's Leftover Disk Data](https://thehackernews.com/2026/09/cloudflare-fixes-flaw-that-let-one.html) — The Hacker News · independent security reporting · 2026-09-25T00:00:00+12:00. Independent account with researcher-side scope and limitations.