Cloudflare fixes tenant data leak vulnerability in Containers and Sandboxes

Cloudflare announced on September 24, 2026 that it fixed a security vulnerability affecting its Containers and Sandboxes services. The flaw allowed any user with a paid Workers plan account to read residual data from previously deleted customer containers on the same server. Cloudflare said the exposed data was limited to leftover storage spaces and did not include running workloads, while researchers reported extracting residual data in 18 out of 24 attempts on production environments across four continents. Researcher Oren Yomtov of Accomplish reported the vulnerability on September 4, 2026, and no official CVE ID was assigned. Cloudflare remediated the issue in two phases: re-enabling zeroing of newly allocated blocks, then decommissioning all running container disks and clearing affected caches, completing cleanup on September 19, 2026, with no evidence of external exploitation.