---
title: "How Cloudflare addressed a cross-tenant data exposure vulnerability in Containers"
description: "Security researcher Oren Yomtov reported a vulnerability in Cloudflare Containers and Sandboxes through the bug bounty program, demonstrating that a Workers Paid account could recover residual disk blocks from previous containers on the same host. The issue arose from Linux device mapper thin provisioning with skip_block_zeroing enabled, which left unzeroed 64 KiB blocks when a 4 KiB write triggered allocation, allowing the remaining 60 KiB to retain prior data. Researchers recovered directory structures, database pages, and structurally complete SQLite databases from 18 of 24 placements across four continents, using ext4 checksums to distinguish foreign blocks. Cloudflare removed skip_block_zeroing, retired all running container disks, and cleared cached image snapshots created before the mitigation, completing cleanup by September 19. Retained disk-I/O telemetry showed no evidence of malicious exploitation, and the researchers confirmed secure deletion of recovered data."
---

# How Cloudflare addressed a cross-tenant data exposure vulnerability in Containers

[Cloudflare](https://yomu.fyi/company/cloudflare) · Hrushikesh Deshpande · Sep 24, 2026

**Type:** Incident / postmortem

## Summary

Security researcher Oren Yomtov reported a vulnerability in Cloudflare Containers and Sandboxes through the bug bounty program, demonstrating that a Workers Paid account could recover residual disk blocks from previous containers on the same host. The issue arose from Linux device mapper thin provisioning with skip\_block\_zeroing enabled, which left unzeroed 64 KiB blocks when a 4 KiB write triggered allocation, allowing the remaining 60 KiB to retain prior data. Researchers recovered directory structures, database pages, and structurally complete SQLite databases from 18 of 24 placements across four continents, using ext4 checksums to distinguish foreign blocks. Cloudflare removed skip\_block\_zeroing, retired all running container disks, and cleared cached image snapshots created before the mitigation, completing cleanup by September 19. Retained disk-I/O telemetry showed no evidence of malicious exploitation, and the researchers confirmed secure deletion of recovered data.

## Context

Cloudflare Containers used Linux device mapper thin provisioning with skip\_block\_zeroing enabled, which allowed residual data from previous containers to be recovered by a new container on the same host. The vulnerability was reported by security researcher Oren Yomtov through the bug bounty program.

## Approach / What changed

Cloudflare removed skip\_block\_zeroing from the dm-thin pool configuration across the fleet, retired all running container disks, and cleared cached image snapshots created before the mitigation. This restored default zeroing behavior and eliminated residual data exposure.

## Takeaways

- The vulnerability exploited dm-thin’s skip\_block\_zeroing option, which left unzeroed 64 KiB blocks when a small write triggered allocation, allowing residual data from previous containers to be read.
- Researchers used ext4 directory block checksums to distinguish foreign blocks from their own test filesystem, recovering directory structures, database pages, and SQLite databases.
- Cloudflare’s remediation required no customer-side changes and involved removing skip\_block\_zeroing, retiring running disks, and clearing cached snapshots across the fleet.

## FAQ

### How did the vulnerability allow data exposure?

The vulnerability used Linux device mapper thin provisioning with skip\_block\_zeroing enabled. When a new container wrote a small 4 KiB block into an unmapped 64 KiB region, dm-thin allocated a physical block without zeroing the remainder, leaving up to 60 KiB of residual data from a previous container readable through raw device reads.

### Could an attacker target a specific victim?

No, an attacker could not select a particular victim or access an actively attached disk. Exposure depended on workload placement and which previously released blocks dm-thin reassigned, making targeting impossible.

### What evidence of exploitation was found?

Cloudflare reviewed retained disk-I/O telemetry and found no evidence of malicious exploitation. Activity attributed to the technique came from the researchers and Cloudflare engineers conducting authorized validation.

**Tags:** [Cloudflare](https://yomu.fyi/topic/cloudflare), [Containers](https://yomu.fyi/topic/containers), [Multi-tenant](https://yomu.fyi/topic/multi-tenant), [Security](https://yomu.fyi/topic/security), [Vulnerabilities](https://yomu.fyi/topic/vulnerabilities)

- Source: [Cloudflare](https://blog.cloudflare.com/containers-cross-tenant-vulnerability)
- Source URL: https://blog.cloudflare.com/containers-cross-tenant-vulnerability
- Ingested by Yomu: 2026-09-24T18:00:08.424Z

[Read original post](https://blog.cloudflare.com/containers-cross-tenant-vulnerability)