Cloudflare’s Containers Read the Last Tenant’s Disk, in a Bite

One Cloudflare customer could read the last tenant’s disk blocks.

• Cloudflare Containers, Sandboxes and Browser Run shared a disk allocation bug. A customer on a Workers Paid plan could recover residual disk blocks from another customer’s container on the same host.
• The cause was thin provisioning with block zeroing off. A 4 KiB write allocated a recycled 64 KiB block, and the other 60 KiB of the previous tenant’s data stayed readable through a raw device read.
• Accomplish found residual data on 18 of 24 container placements and 20 of 22 hosts across four continents, including structurally complete SQLite databases and .env credential files.
• Cloudflare fixed it, rolled the change out automatically, and found no evidence of exploitation. An attacker also could not pick a victim or touch an actively attached disk.
• It is the sixth sandbox isolation escape Accomplish has published since July. The runtime was isolated. The disk underneath was not.

Read the full analysis. Cloudflare’s Sandboxes Read the Last Tenant’s Disk