← Tuesday, October 6, 2026SecurityVulnerability

Cloudflare Containers vulnerability exposed residual disk blocks across tenants

blog.cloudflare.com 7 min read Editor score 9/10

Researchers showed that a customer could recover residual disk blocks previously used by Containers on the same host, though they could not target a particular customer or workload. The cross-tenant isolation failure is directly relevant to engineers operating multi-tenant infrastructure.

What: Cloudflare fixed a vulnerability that let a customer potentially recover residual disk blocks previously used by Containers on the same host.
How: With block zeroing disabled, a 4 KiB write into a newly allocated 64 KiB thin block could leave 60 KiB of its previous contents intact.
Why it matters: The issue highlights cross-tenant storage-isolation risks in shared infrastructure; Cloudflare remediated the fleet without customer changes.

Container disk writes pass through dm-thin, which allocates blocks from a shared storage pool. Sketched from the article's own text.

Read on blog.cloudflare.com → Lobsters

Discussion

Discussion is not switched on yet. Use Note above to keep your own thoughts on this story.

Headline, summary, brief and diagram are written by a model from the source's own text; the link, byline and numbers come from the source. Read the original before relying on a claim.