Cloudflare, a leading cloud-based security and content delivery network provider, has patched a critical vulnerability that could have allowed an attacker to access sensitive data from other customers’ containers. The flaw, discovered by researchers, was present in Cloudflare’s serverless computing platform, Workers.
The issue is significant because it allows for cross-container privilege escalation, a type of attack where an unauthorized actor gains elevated privileges within the same environment as another user or service. In this case, if one container had permission to access another customer’s leftover disk data, an attacker could potentially exploit this information to breach other systems or escalate their own privileges.
The vulnerability arose from how Cloudflare handles garbage collection and cleanup of serverless containers. When a container is terminated, its contents are not immediately deleted; instead, they remain on the disk until the system can reclaim them. However, if an attacker gains access to one container that has write permissions to another’s leftover data, they could potentially read sensitive information from the other customer’s container.
The researchers who discovered the flaw were able to demonstrate how it could be exploited in a real-world scenario. They created two containers on Cloudflare Workers, with one having permission to delete files and the other containing sensitive data that was left behind after deletion. By using the permissions of the first container, they were able to access the leftover data from the second container.
The vulnerability is particularly concerning because it affects not only individual users but also entire organizations. If an attacker gains access to sensitive information through this route, it could lead to serious security breaches and potentially even result in identity exposure for multiple customers.
Cloudflare’s swift response to address the issue is reassuring; however, it serves as a reminder that cloud-based platforms are not immune to security risks. As more users rely on serverless computing and cloud services, vulnerabilities like this one will continue to surface unless proper precautions are taken.
To mitigate similar risks in your own organization, consider implementing robust access controls and monitoring for unusual activity within your cloud environment. Regularly review and update your security protocols to ensure they can adapt to emerging threats and vulnerabilities.
Source: The Hacker News — 2026-09-25