Key Takeaways
- Cloudflare Containers exposed cross-tenant disk-block remnants after a dm-thin pool option disabled block zeroing.
- A 4 KiB write could allocate a 64 KiB thin block and leave up to 60 KiB readable from a previous tenant.
- The fix required removing skip_block_zeroing and rebuilding disks and cached OCI layers from zeroed allocations.
Table of Contents
Cloudflare’s Container Storage Gap Exposed a Cross-Tenant Data Channel
Cloudflare’s engineering blog has published the full technical account of a cross-tenant data exposure fault in Cloudflare Containers, triggered by a single storage-pool option that skipped block zeroing.
Researcher Oren Yomtov from Accomplish submitted the proof of concept through HackerOne on September 4, 2026, and Cloudflare completed fleet-wide remediation by September 19.
The flaw let a Workers Paid account recover residual disk blocks previously used by other customers’ containers on the same host, though it could not target any particular victim or guarantee that stale data was present.
In its technical disclosure, Cloudflare found no evidence of exploitation beyond the researcher’s authorized validation and its own internal reproduction.
The dm-thin Zeroing Flaw That Turned Small Writes Into a Recovery Tool
Cloudflare Containers operate on multi-tenant infrastructure and rely on Linux device mapper thin provisioning, commonly known as dm-thin, to allocate writable root disks.
Each container runs inside a Firecracker virtual machine, which exposes that root disk as /dev/vdc and allocates physical storage only when a virtual disk writes to an unmapped region.
The affected pools used a 64 KiB thin-block size and included the configuration option skip_block_zeroing.
That setting disabled dm-thin’s default behavior of clearing newly allocated blocks before exposing them to a container.
As a result, a full-block write could replace the previous contents, but a smaller write changed only the written slice and left the remainder of the block carrying data from a former tenant.
The proof of concept exploited that behavior through four steps:
- Create a container using a Workers Paid account.
- Open /dev/vdc and record a raw baseline of the disk.
- Write one 4 KiB aligned block into selected 64 KiB regions matching ext4 free space.
- Read the blocks again and inspect only the portions not overwritten by the new container.
When a 4 KiB write hit an unmapped thin block, dm-thin allocated a physical 64 KiB block from the shared pool and left up to 60 KiB readable from the previous owner.
The researchers distinguished foreign data by using ext4 directory block checksums tied to the filesystem and inode.
The validation produced sharp results:
- 5,614 testable directory blocks examined.
- Zero blocks attributed to the researchers’ own filesystem.
- 2,700 distinct foreign directory inodes identified.
- 18 of 24 placements and 20 of 22 underlying nodes showed residual material across four continents.
The recovered block types included directory structures, database pages, and structurally complete SQLite databases.
Cloudflare mitigated the immediate risk by removing skip_block_zeroing from pool configurations, which restored default clearing and stopped the reported technique.
However, that did not sanitize blocks already mapped into running container disks or cached OCI image snapshots.
Cloudflare therefore retired running container disks, drained hosts during off-peak hours, restarted virtual machines, and cleared pre-mitigation image caches so all disks and layers were rebuilt from zeroed allocations.
The fleet-wide cleanup was completed on September 19, 2026.
Why Multi-Tenant AI Infrastructure Cannot Afford Silent Storage Reuse
The vulnerability is a storage-isolation failure, but its strategic weight lands hardest on AI infrastructure because multi-tenant container layers are becoming the default execution surface for inference, agentic automation, and sandboxed model evaluation.
Recent ecosystem coverage adds the same pressure: LiquidAI’s DSpark Drafter is being positioned around a 3x edge vision decoding jump, Shopify’s GraphQL agent points to a 96 percent serving cost reduction, and vLLM’s portable-layer work keeps non-NVIDIA GPUs within 3.4 percent.
Each of those improvements assumes a clean isolation boundary; silent storage reuse would undercut the exact efficiency and portability gains those teams are pursuing.
The Cloudflare Worker Previews story adds another pressure point: production-grade sandboxes attached to every Git branch increase the number of short-lived tenants sharing the same substrate.
For AI platform operators, the disclosure is a reminder that a hot patch is only the first step.
Cached layers and running disks remain part of the exposure surface until they are rebuilt from verified zeroed allocations, and Cloudflare’s timeline makes that distinction explicit.
A Patching Precedent for the Isolation Lifecycle
Cloudflare’s remediation proves that storage isolation is not a single configuration switch but a lifecycle guarantee: every mapped block must be born from a zeroed allocation. For teams building AI automation and content engines that cannot afford silent storage leakage, programmatic SEO and AI automation is how Andres SEO Expert approaches safer scaling — talk to us.
Frequently Asked Questions
What was the Cloudflare Containers cross-tenant vulnerability?
It was a storage-isolation fault in Cloudflare Containers that let a Workers Paid account recover residual disk blocks previously used by other customers’ containers on the same host. The root cause was a storage-pool option, skip_block_zeroing, that disabled dm-thin block clearing. Researcher Oren Yomtov of Accomplish reported it through HackerOne on September 4, 2026, and Cloudflare completed fleet-wide remediation on September 19, 2026.
What is skip_block_zeroing and why does it break tenant isolation?
Linux device mapper thin provisioning, known as dm-thin, normally clears newly allocated blocks before exposing them to a container. The skip_block_zeroing option disables that clearing. On the affected pools, which used a 64 KiB thin-block size, a full-block write replaced the entire block, but a smaller write changed only the written slice and left the remainder of the block carrying data from a former tenant.
How did the proof of concept recover data from other containers?
It used four steps: create a container on a Workers Paid account; open /dev/vdc inside the Firecracker virtual machine and record a raw baseline; write one 4 KiB aligned block into 64 KiB regions matching ext4 free space; then read the blocks again and inspect only the portions not overwritten. Because a 4 KiB write to an unmapped thin block still allocated a physical 64 KiB block from the shared pool, up to 60 KiB remained readable from the previous owner. Foreign data was confirmed using ext4 directory block checksums tied to the filesystem and inode.
How much foreign data was recovered in the validation?
Of 5,614 testable directory blocks examined, zero belonged to the researchers’ own filesystem and 2,700 distinct foreign directory inodes were identified. Residual material appeared in 18 of 24 placements and 20 of 22 underlying nodes across four continents. Recovered block types included directory structures, database pages, and structurally complete SQLite databases.
Was the Cloudflare Containers flaw exploited in the wild?
No. Cloudflare found no evidence of exploitation beyond the researcher’s authorized validation and its own internal reproduction. The technique also could not target a specific victim or guarantee that stale data would be present, which limited its practical impact even though the isolation failure was real.
Why was removing skip_block_zeroing not enough to fix it?
Removing the option restored default block clearing and stopped the reported technique, but it did not sanitize blocks already mapped into running container disks or cached OCI image snapshots. Cloudflare therefore retired running container disks, drained hosts during off-peak hours, restarted virtual machines, and cleared pre-mitigation image caches so every disk and layer was rebuilt from zeroed allocations. The fleet-wide cleanup finished on September 19, 2026.
Why does this matter for multi-tenant AI infrastructure?
Multi-tenant container layers are becoming the default execution surface for inference, agentic automation, and sandboxed model evaluation, so silent storage reuse undercuts the isolation boundary those workloads assume. Efficiency and portability gains, from faster edge vision decoding to cheaper agent serving to non-NVIDIA GPU support, all depend on that boundary holding. The disclosure shows storage isolation is a lifecycle guarantee, not a single configuration switch, since cached layers and running disks stay in the exposure surface until rebuilt from verified zeroed allocations.
