Cloudflare patches cross‑tenant data leak in Containers and Sandboxes

Cloudflare disclosed that it has patched a vulnerability in its Containers and Sandboxes services that could have allowed customers with a paid Workers plan to retrieve leftover data belonging to other users sharing the same physical host.

The flaw stemmed from incomplete cleanup of container resources, creating a scenario where residual files or memory fragments remained accessible after a tenant's workload terminated. Because multiple customers run isolated workloads on shared infrastructure, the oversight opened a cross‑tenant channel for data exposure.

The issue came to light after security outlet BleepingComputer reported the problem, prompting Cloudflare to investigate and confirm the weakness. While the report did not cite any confirmed instances of exploitation, the potential for accidental data leakage was deemed serious enough to warrant immediate remediation.

In response, Cloudflare rolled out a series of updates that tighten the teardown process for containers, enforce stricter isolation boundaries, and introduce additional verification steps before a tenant can access storage tied to a host. The company also initiated a review of related services to ensure similar gaps do not exist elsewhere in its platform.

Although there is no public evidence that attackers have leveraged the vulnerability, experts note that any cross‑tenant leakage in a multi‑tenant cloud environment can compromise confidential information, ranging from proprietary code to personal data. The incident underscores the ongoing challenges cloud providers face in balancing resource efficiency with robust tenant isolation.

Cloudflare’s swift patching aligns with a broader industry trend where providers are tightening security after a series of high‑profile cross‑tenant incidents in recent years. The company said it will continue monitoring its services, conduct regular audits, and work with the security community to identify and remediate similar risks before they can be abused.