Affected Systems
Cloudflare Containers and Sandboxes service, available to Workers Paid plan customers. All customers using Containers on shared physical hosts were potentially affected. The vulnerability existed from service launch until patched on September 19, 2026.
Exploitation Status
Proof-of-concept demonstrated by security researcher Oren Yomtov (Accomplish) via HackerOne on September 4, 2026. Researchers recovered residual data in 18 of 24 container placements tested. No evidence of exploitation in the wild or actual customer data exposure found in Cloudflare's log analysis.
Business Impact
Cross-tenant isolation breach allowed Workers Paid account holders to read residual storage blocks from other customers' deleted containers on the same physical host. Exposed data types included directory listings, SQLite databases, Chromium profiles, .env files, and credential files. Attack required paid Cloudflare account access and specific disk allocation techniques. Read-only exposure—no ability to modify data or disrupt workloads. Cloudflare applied automatic infrastructure fixes; no customer action required.
Urgency
🟡 Within a week
Recommended Actions
- Verify your organization does not use Cloudflare Containers service; if you do, confirm all container instances are running post-September 19, 2026 (fixes applied automatically)
- Rotate credentials and secrets (API keys, database passwords, OAuth tokens) that were stored in Cloudflare Containers prior to September 19, 2026, especially in .env files or application configuration
- Review application logs and Cloudflare Workers audit logs for unusual container creation patterns or access from September 4-19, 2026
- If sensitive data was processed in Cloudflare Containers, assess exposure risk based on data classification and consider breach notification obligations if regulated data was involved
- For future deployments, implement secrets management solutions (e.g., Cloudflare Workers Secrets, HashiCorp Vault) rather than storing credentials in container filesystems