Cloudflare disclosed a storage flaw in Containers and Sandboxes on September 24 after fixing it across the affected fleet. Researcher Oren Yomtov of Accomplish had reported the issue on September 4 through the company’s bug-bounty program.
The flaw allowed residual disk blocks from a deleted container to be read by a later container on the same host. Each workload ran inside its own virtual machine, but the underlying storage configuration did not clear newly allocated blocks before making them accessible.
The technique could not target a particular customer, workload or physical host, and recoverable data was not guaranteed to be present. Those limits narrowed the attack’s reach without removing the cross-customer confidentiality problem.
Cloudflare says no customer configuration change is required. Within the historical disk-activity records available to its investigation, it found no evidence of malicious exploitation; activity it could attribute to the technique came from the researchers and its own validation work. The disclosure does not establish that customer data was stolen.