Affected Systems

Cloudflare Containers and Cloudflare Sandboxes. All customers using these services were potentially affected. The vulnerability stemmed from thin-provisioned disk blocks not being wiped before reallocation across customer accounts. Cloudflare has patched all systems; no customer action required.

Exploitation Status

Proof-of-concept demonstrated by Accomplish security researchers on September 4, 2024. Researchers successfully recovered leftover data in 18 of 24 attempts across production systems. Cloudflare's log analysis found no evidence of exploitation beyond authorized researcher and internal testing. No CVE assigned.

Business Impact

Paying customers could read deallocated disk blocks containing fragments of other customers' data, including directory structures, SQLite databases, browser profiles, .env files, and credentials. Attackers could not target specific customers or access live workloads. The exposure window is unclear as Cloudflare did not disclose when the unsafe disk configuration was introduced. Organizations using Cloudflare Containers or Sandboxes for sensitive workloads face potential data leakage risk, though Cloudflare reports the issue is fully remediated as of September 19, 2024.

Urgency

🟡 Within a week

Recommended Actions

  • Review what sensitive data was processed in Cloudflare Containers or Sandboxes during 2024 and assess exposure risk, particularly credentials, API keys, and database contents stored in .env files or SQLite databases.
  • Rotate credentials and API keys that were used in Cloudflare Containers or Sandboxes environments, especially those stored in configuration files or environment variables.
  • Verify that Cloudflare has confirmed remediation for your account if you are a Containers or Sandboxes customer; no customer action is required for the patch itself.
  • If using Cloudflare Sandboxes to run untrusted or AI-generated code, reassess the trust boundary and consider additional isolation layers for highly sensitive operations.
  • Monitor Cloudflare's disclosure for updates on the exposure timeline and any additional guidance regarding data at risk.